CVE-2026-33374
Last modified
CVE-2026-33374 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.. EPSS estimates a 0.37% chance of exploitation in the next 30 days.
Description
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana Enterprise | >= 12.0.0, <= 12.3.11; >= 12.4.0, < 12.4.13; >= 13.0.0, < 13.0.11; >= 13.1.0, < 13.1.8; >= 13.2.0, < 13.2.4 |
| Grafana | Grafana OSS | >= 12.0.0, <= 12.3.11; >= 12.4.0, < 12.4.13; >= 13.0.0, < 13.0.11; >= 13.1.0, < 13.1.8; >= 13.2.0, < 13.2.4 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-33374?
How severe is CVE-2026-33374?
How do I fix CVE-2026-33374?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-33369Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP in…4.3
- CVE-2026-3337Observable timing discrepancy in AES-CCM decryption in AWS-L…8.2
- CVE-2026-33370An issue was discovered in Zimbra Collaboration (ZCS) 10.0 a…6.1
- CVE-2026-33371An issue was discovered in Zimbra Collaboration (ZCS) 10.0 a…4.3
- CVE-2026-33372An issue was discovered in Zimbra Collaboration (ZCS) 10.0 a…5.4
- CVE-2026-33373An issue was discovered in Zimbra Collaboration (ZCS) 10.0 a…8.8
- CVE-2026-33375The Grafana MSSQL data source plugin contains a logic flaw t…6.5
- CVE-2026-33376When using an IPv6 allow-list for the Auth Proxy feature, it…7.4
- CVE-2026-33377An Editor can overwrite a dashboard not owned by them to acq…7.1
- CVE-2026-33378Using the $__timeGroup macro, one can achieve an OOM by over…6.5
- CVE-2026-33379A user with any role, including Viewer or a service account …8.5
- CVE-2026-3338Improper signature validation in PKCS7_verify() in AWS-LC al…8.7
Are you affected by CVE-2026-33374?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST