VYPR
Unrated severityNVD Advisory· Published Jun 22, 2026· Updated Jun 22, 2026

Grafana pre-auth DoS through arbitrarily large input to public dashboard query handler

CVE-2026-42127

Description

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

Affected products

1

Patches

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.