Log in Start free

Vulnerability · Published Apr 24, 2026 · Assigned by GRAFANA

CVE-2026-21728Tempo query limit results in unbounded memory allocation

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Enterprise Traces (GET) from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 49.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/grafana/tempo2.8.4GHSA-p4r4-xvrq-gvmc
Gogithub.com/grafana/tempo2.9.2GHSA-p4r4-xvrq-gvmc
Gogithub.com/grafana/tempo2.10.2GHSA-p4r4-xvrq-gvmc
Gogithub.com/grafana/tempono fix listedGO-2026-5528

Affected products (as reported)

VendorProductVersions
Grafana Tempo 1.3.0 – through 2.8.32.9.0 – through 2.9.12.10.0 – through 2.10.1
Grafana Enterprise Traces (GET) 1.0.0 – through 2.8.7

Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References