CVE-2026-33382

A flaw in Grafana's API endpoints allows remote attackers to send excessively large request bodies without authentication. This exhausts server memory, resulting in a complete denial of service (DoS).

Moderate: This denial of service vulnerability in Grafana stems from a lack of request body size limits on certain API endpoints, some of which are unauthenticated. Exploitation by a remote attacker sending large payloads can exhaust system memory, leading to service unavailability. The impact is assessed as Moderate because it primarily affects the availability of the Grafana application rather than compromising data or executing arbitrary code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Deploy a reverse proxy or API gateway (e.g., Nginx) in front of Grafana configured to strictly limit the maximum HTTP request body size, dropping oversized payloads before they reach the backend. As a defense-in-depth measure, restrict network access to trusted internal clients via firewall rules. Note: Applying these proxy and network changes may require a service reload, causing a temporary interruption.