CVE-2026-21720
HIGH EPSS 37.4%
Published Jan 27, 20265mo ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
Published Jan 27, 2026 5mo ago
Last Modified Jun 17, 2026 2w ago
Description
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
37.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 2
CWE-400 Uncontrolled Resource Consumption Resource Mgmt
CWE-703
Affected Products 10
| Vendor | Product | Version | Range |
|---|---|---|---|
| grafana | grafana | * | ≥3.0.0 – <11.6.9 |
| grafana | grafana | * | ≥3.0.0 – <11.6.9 |
| grafana | grafana | * | ≥12.0.0 – <12.0.8 |
| grafana | grafana | * | ≥12.0.0 – <12.0.8 |
| grafana | grafana | * | ≥12.1.0 – <12.1.5 |
| grafana | grafana | * | ≥12.1.0 – <12.1.5 |
| grafana | grafana | * | ≥12.2.0 – <12.2.3 |
| grafana | grafana | * | ≥12.2.0 – <12.2.3 |
| grafana | grafana | 12.3.0 | any |
| grafana | grafana | 12.3.0 | any |
References 1
- grafana.com https://grafana.com/security/security-advisories/cve-2026-21720
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.