CVE-2026-33374

A flaw was found in Grafana. The Prometheus rule conversion API endpoints fail to enforce a limit on request body sizes. An authenticated user can exploit this vulnerability by submitting excessively large requests to trigger unbounded memory allocation, which crashes the server and results in a Denial of Service (DoS).

This issue is rated Moderate. An authenticated Grafana user who can call the Prometheus rule conversion API can submit an oversized request body that triggers unbounded memory allocation and can crash the Grafana process (denial of service). There is no confidentiality or integrity impact from this flaw. Exploitation requires a valid account with access to the conversion API, and the availability impact is limited to the Grafana service itself.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict access to the Grafana UI and HTTP API to trusted clients and administrative networks. Limit accounts that can authenticate to Grafana and review roles that can use alerting or Prometheus rule conversion APIs. Apply process or cgroup memory limits to reduce out-of-memory blast radius.