Grafana Viewer Recursion Crash via Math Expression
CVE-2026-88858 Published on October 28, 2026
Server-side expression parser denial of service
A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
Weakness Types
What is a Stack Exhaustion Vulnerability?
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.
CVE-2026-88858 has been classified to as a Stack Exhaustion vulnerability or weakness.
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
What is a Resource Exhaustion Vulnerability?
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVE-2026-88858 has been classified to as a Resource Exhaustion vulnerability or weakness.
Products Associated with CVE-2026-88858
Want to know whenever a new CVE is published for Grafana Labs Grafana? stack.watch will email you.
Affected Versions
Grafana OSS:- Version 7.4.0, <= 11.6.16 is affected.
- Version 12.0.0, <= 12.2.10 is affected.
- Version 12.3.0, <= 12.3.11 is affected.
- Version 12.4.0, <= 12.4.13 is affected.
- Version 13.0.0, <= 13.0.11 is affected.
- Version 13.1.0, <= 13.1.8 is affected.
- Version 13.2.0, <= 13.2.4 is affected.
- Version 7.4.0, <= 11.6.16 is affected.
- Version 12.0.0, <= 12.2.10 is affected.
- Version 12.3.0, <= 12.3.11 is affected.
- Version 12.4.0, <= 12.4.13 is affected.
- Version 13.0.0, <= 13.0.11 is affected.
- Version 13.1.0, <= 13.1.8 is affected.
- Version 13.2.0, <= 13.2.4 is affected.