VYPR
← All advisories
Medium severity6.5NVD Advisory· Published May 13, 2026· Updated May 28, 2026

CVE-2026-33378

CVE-2026-33378

Description

Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

16
  • Grafana/Grafana11 versions
    cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*+ 10 more
    • cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*range: >=8.0.0,<11.6.14
    • cpe:2.3:a:grafana:grafana:11.6.14:-:*:*:*:*:*:*
    • cpe:2.3:a:grafana:grafana:11.6.14:security01:*:*:*:*:*:*
    • cpe:2.3:a:grafana:grafana:12.2.8:-:*:*:*:*:*:*
    • cpe:2.3:a:grafana:grafana:12.2.8:security01:*:*:*:*:*:*
    • cpe:2.3:a:grafana:grafana:12.3.6:-:*:*:*:*:*:*
    • cpe:2.3:a:grafana:grafana:12.3.6:security01:*:*:*:*:*:*
    • cpe:2.3:a:grafana:grafana:12.4.3:-:*:*:*:*:*:*
    • cpe:2.3:a:grafana:grafana:13.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:grafana:grafana:13.0.1:-:*:*:*:*:*:*
    • (no CPE)
  • osv-coords5 versions
    pkg:apk/chainguard/grafana-12.4pkg:apk/wolfi/grafana-12.4pkg:bitnami/grafanapkg:rpm/opensuse/grafana&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/grafana&distro=openSUSE%20Tumbleweed
    < 12.4.3.02-r0+ 4 more
    • (no CPE)range: < 12.4.3.02-r0
    • (no CPE)range: < 12.4.3.02-r0
    • (no CPE)range: >= 8.0.0, < 11.6.14
    • (no CPE)range: < 11.6.14+security04-bp160.1.1
    • (no CPE)range: < 11.6.14+security04-1.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.