CVE-2026-28375
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Mar 27, 2026
CISA due date
—
The record
A testdata data-source can be used to trigger out-of-memory crashes in Grafana.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | grafana-11.6 | 0 | 0 |
| Chainguard | grafana-12.1 | 0 | 0 |
| Chainguard | grafana-12.2 | 0 | 0 |
| Chainguard | grafana-12.3 | 0 | 0 |
| Chainguard | grafana-fips-11.6 | 0 | 11.6.14-r2 |
| Wolfi | grafana-11.6 | 0 | 0 |
| Wolfi | grafana-12.1 | 0 | 0 |
| Wolfi | grafana-12.2 | 0 | 0 |
| Wolfi | grafana-12.3 | 0 | 0 |
| openSUSE:Leap 16.0 | grafana | 0 | 11.6.14+security04-bp160.1.1 |
| openSUSE:Tumbleweed | grafana | 0 | 11.6.14+security01-1.1 |
Related vulnerabilities
- CVE-2026-27879 A resample query can be used to trigger out-of-memory crashes in Grafana. Also affects grafana-11.6
- CVE-2026-27877 When using public dashboards and direct data-sources, all direct data-sources' passwords… Also affects grafana-11.6
- CVE-2026-27876 A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote… Also affects grafana-11.6
- CVE-2026-32285 The Delete function fails to properly validate offsets when processing malformed JSON… Also affects grafana-11.6
- CVE-2025-11065 A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing… Also affects grafana-11.6
- CVE-2024-6485 A security vulnerability has been discovered in bootstrap that could enable Cross-Site… Also affects grafana-11.6
- CVE-2026-25934 go-git is a highly extensible git implementation library written in pure Go. Also affects grafana-12.1
- CVE-2026-24001 jsdiff is a JavaScript text differencing implementation. Also affects grafana-12.1