CVE-2026-21728

A flaw was found in Tempo. A remote attacker can exploit this vulnerability by sending large queries to the Tempo service. This can lead to excessive memory allocations, potentially causing a Denial of Service (DoS) by impacting the availability of the service.

This vulnerability is rated as having an Important security impact because remote unauthenticated actors can send queries configured with excessively large limit values, inducing unbounded memory consumption that results in a denial of service. In Red Hat OpenShift distributed tracing environments, components exposing query interfaces directly to untrusted networks face availability risks if inbound queries are unconstrained. Deployments where query endpoints are restricted to authenticated internal users or protected by ingress rate-limiting face a reduced operational risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.