Grafana Plugin Resources OOM DoS via Authenticated User
CVE-2026-28383 Published on May 13, 2026
Grafana plugin resources can lead to unbounded memory allocation
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.
Weakness Type
Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Products Associated with CVE-2026-28383
Want to know whenever a new CVE is published for Grafana Labs Grafana? stack.watch will email you.
Affected Versions
Grafana OSS:- Version 6.7.0, <= 11.6.14 is affected.
- Version 11.6.14 and below 11.6.14+security-04 is affected.
- Version 12.0.0, <= 12.2.8 is affected.
- Version 12.2.8 and below 12.2.8+security-04 is affected.
- Version 12.3.0, <= 12.3.6 is affected.
- Version 12.3.6 and below 12.3.6+security-04 is affected.
- Version 12.4.0, <= 12.4.3 is affected.
- Version 12.4.3 and below 12.4.3+security-02 is affected.
- Version 13.0.0, <= 13.0.1 is affected.
- Version 13.0.1 and below 13.0.1+security-01 is affected.