CVE-2026-33374: Grafana Unbounded Memory Allocation in Prometheus Rule Conversion API
Summary
CVE-2026-33374: Unbounded memory allocation in the Prometheus rule conversion API. Affects grafana across 4 version ranges.
>= 12.0.0, < 12.4.13
>= 13.0.0, < 13.0.11
>= 13.1.0, < 13.1.8
>= 13.2.0, < 13.2.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grafana is an open-source analytics and monitoring platform that allows users to visualize and analyze data from various sources. It is widely used for monitoring applications and infrastructure. The platform includes a Prometheus rule conversion API, which is designed to facilitate the conversion of Prometheus alerting rules into Grafana-compatible formats. However, this API has a significant vulnerability that can lead to severe performance issues.
Vulnerability Detail
The vulnerability arises from the Prometheus rule conversion API endpoints in Grafana, which do not impose any limits on the size of the request body. This oversight allows authenticated users to send excessively large requests, leading to unbounded memory allocations. As a result, the server may experience out-of-memory conditions, potentially crashing and disrupting service availability. This vulnerability is particularly concerning as it can be exploited by users with legitimate access, making it difficult to mitigate without proper safeguards.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 12.0.0, < 12.4.1312.4.13 -
>= 13.0.0, < 13.0.1113.0.11 -
>= 13.1.0, < 13.1.813.1.8 -
>= 13.2.0, < 13.2.413.2.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, it is advisable to monitor user access and limit the ability of authenticated users to send large requests until the package can be updated.
Conclusion
CVE-2026-33374 presents a significant risk to Grafana users, allowing authenticated users to exploit the Prometheus rule conversion API. It is crucial to update to the latest patched versions to prevent potential server crashes and ensure service reliability.
See every vulnerability recorded for grafana →
FAQ
CVE-2026-33374 is a vulnerability in Grafana that allows authenticated users to trigger unbounded memory allocations through the Prometheus rule conversion API, potentially crashing the server.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The main consequence is that the server may crash due to out-of-memory conditions, leading to service disruptions and potential downtime.
You can update Grafana to a patched version using your package manager. Ensure you upgrade to one of the fixed versions: 12.4.13, 13.0.11, 13.1.8, or 13.2.4.
While there are no specific workarounds, limiting user access and monitoring request sizes may help mitigate the risk until an update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for grafana.
