CVE-2026-21720
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Jan 27, 2026
CISA due date
—
The record
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | grafana-11.4 | 0 | 11.4.8-r3 |
| Chainguard | grafana-fips-11.5 | 0 | 11.5.10-r2 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | golang-github-prometheus-promu | 0 | 0.17.0-150000.3.30.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | grafana | 0 | 11.6.11-150200.3.83.1 |
| SUSE:Manager Client Tools 15 | dracut-saltboot | 0 | 1.1.0-150000.1.65.1 |
| SUSE:Manager Client Tools 15 | golang-github-QubitProducts-exporter_exporter | 0 | 0.4.0-150000.1.21.1 |
| SUSE:Manager Client Tools 15 | golang-github-boynux-squid_exporter | 0 | 1.13.0-150000.1.12.1 |
| SUSE:Manager Client Tools 15 | golang-github-lusitaniae-apache_exporter | 0 | 1.0.10-150000.1.26.1 |
| SUSE:Manager Client Tools 15 | golang-github-prometheus-prometheus | 0 | 3.5.0-150000.3.67.1 |
| SUSE:Manager Client Tools 15 | grafana | 0 | 11.6.11-150000.1.90.1 |
| SUSE:Manager Client Tools 15 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.30.2 |
| SUSE:Manager Client Tools 15 | spacecmd | 0 | 5.0.15-150000.3.142.1 |
| SUSE:Manager Client Tools 15 | uyuni-tools | 0 | 0.1.38-150000.1.30.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | dracut-saltboot | 0 | 1.1.0-150000.1.65.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | golang-github-QubitProducts-exporter_exporter | 0 | 0.4.0-150000.1.21.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.30.2 |
| SUSE:Manager Client Tools for SLE Micro 5 | uyuni-tools | 0 | 0.1.38-150000.1.30.1 |
| Wolfi | grafana-11.4 | 0 | 11.4.8-r3 |
| openSUSE:Leap 15.6 | dracut-saltboot | 0 | 1.1.0-150000.1.65.1 |
| openSUSE:Leap 15.6 | golang-github-QubitProducts-exporter_exporter | 0 | 0.4.0-150000.1.21.1 |
| openSUSE:Leap 15.6 | golang-github-boynux-squid_exporter | 0 | 1.13.0-150000.1.12.1 |
| openSUSE:Leap 15.6 | golang-github-lusitaniae-apache_exporter | 0 | 1.0.10-150000.1.26.1 |
| openSUSE:Leap 15.6 | golang-github-prometheus-promu | 0 | 0.17.0-150000.3.30.1 |
| openSUSE:Leap 15.6 | grafana | 0 | 11.6.11-150200.3.83.1 |
| openSUSE:Leap 15.6 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.30.2 |
| openSUSE:Leap 15.6 | spacecmd | 0 | 5.0.15-150000.3.142.1 |
| openSUSE:Tumbleweed | grafana | 0 | 11.6.14+security01-1.1 |
Related vulnerabilities
- CVE-2026-21722 Public dashboards with annotations enabled did not limit their annotation timerange to… Also affects grafana-11.4
- CVE-2026-21721 The dashboard permissions API does not verify the target dashboard scope and only checks… Also affects grafana-11.4
- CVE-2024-6485 A security vulnerability has been discovered in bootstrap that could enable Cross-Site… Also affects grafana-11.4
- CVE-2026-27606 Rollup is a module bundler for JavaScript. Also affects golang-github-prometheus-promu
- CVE-2026-1615 Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection… Also affects golang-github-prometheus-promu
- CVE-2026-25547 @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Also affects golang-github-prometheus-promu
- CVE-2025-61140 The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution. Also affects golang-github-prometheus-promu
- CVE-2025-13465 Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the… Also affects golang-github-prometheus-promu