CVE-2026-33378
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
May 13, 2026
CISA due date
—
The record
Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | grafana | 0 | 11.6.14+security04-bp160.1.1 |
| openSUSE:Tumbleweed | grafana | 0 | 11.6.14+security04-1.1 |
Related vulnerabilities
- CVE-2026-27136 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that… Also affects grafana
- CVE-2026-42506 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-42502 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-25681 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-25680 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of… Also affects grafana
- CVE-2026-28380 Any Editor could delete any snapshot, even if they have no access to read or write them. Also affects grafana
- CVE-2026-28383 A request to the Grafana plugin resources endpoint can cause unbounded memory allocation… Also affects grafana