BIT-grafana-2026-21720

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-21720.json
JSON Data
https://api.test.osv.dev/v1/vulns/BIT-grafana-2026-21720
Aliases
Published
2026-02-18T17:41:21Z
Modified
2026-07-06T08:00:20Z
Summary
Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out
Details

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*"
    ],
    "severity":  "High"
}
References

Affected packages

Bitnami / grafana

Package

Name
grafana
Purl
pkg:bitnami/grafana

Severity

  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
3.0.0
Fixed
11.6.9
Introduced
12.0.0
Fixed
12.0.8
Introduced
12.1.0
Fixed
12.1.5
Introduced
12.2.0
Fixed
12.2.3
Introduced
12.3.0
Fixed
12.3.1

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-21720.json"