CVE-2026-28383

A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.

Database specific

{
    "cna_assigner": "GRAFANA",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28383.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "6.7.0"
                },
                {
                    "last_affected": "11.6.14"
                },
                {
                    "introduced": "11.6.14"
                },
                {
                    "fixed": "11.6.14+security-04"
                },
                {
                    "introduced": "12.0.0"
                },
                {
                    "last_affected": "12.2.8"
                },
                {
                    "introduced": "12.2.8"
                },
                {
                    "fixed": "12.2.8+security-04"
                },
                {
                    "introduced": "12.3.0"
                },
                {
                    "last_affected": "12.3.6"
                },
                {
                    "introduced": "12.3.6"
                },
                {
                    "fixed": "12.3.6+security-04"
                },
                {
                    "introduced": "12.4.0"
                },
                {
                    "last_affected": "12.4.3"
                },
                {
                    "introduced": "12.4.3"
                },
                {
                    "fixed": "12.4.3+security-02"
                },
                {
                    "introduced": "13.0.0"
                },
                {
                    "last_affected": "13.0.1"
                },
                {
                    "introduced": "13.0.1"
                },
                {
                    "fixed": "13.0.1+security-01"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/grafana/grafana

Affected ranges

Type

GIT

Repo

https://github.com/grafana/grafana

Events

Introduced

6134e3cf35a99c7dd3041b7ececb47cb7619ba9a

Fixed

4da40799451631e6c8591c841282447cdf55be3d

Introduced

92f1fba9b4b6700328e99e97328d6639df8ddc3d

Fixed

576f2e81b33bc857df779c95cb38effaa6c58b03

Introduced

20051fb1fc604fc54aae76356da1c14612af41d0

Fixed

3b85eb0d9490f36d682e4fe55684f7da7b8b99b6

Introduced

d1729c53a7f44e2e58947eb44eb896c2fb1c30b3

Fixed

86c83248f8739fbc178c0e5c451b44bdba7b5ed7

Introduced

Database specific

{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "8.5.0"
        },
        {
            "fixed": "11.6.14"
        },
        {
            "introduced": "12.2.0"
        },
        {
            "fixed": "12.2.8"
        },
        {
            "introduced": "12.3.0"
        },
        {
            "fixed": "12.3.6"
        },
        {
            "introduced": "12.4.0"
        },
        {
            "fixed": "12.4.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "11.6.14-NA"
        },
        {
            "last_affected": "11.6.14-security01"
        },
        {
            "last_affected": "12.2.8-NA"
        },
        {
            "last_affected": "12.2.8-security01"
        },
        {
            "last_affected": "12.3.6-NA"
        },
        {
            "last_affected": "12.3.6-security01"
        },
        {
            "last_affected": "12.4.3-NA"
        },
        {
            "last_affected": "13.0.0"
        },
        {
            "last_affected": "13.0.1-NA"
        }
    ],
    "cpe": [
        "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:grafana:grafana:11.6.14:-:*:*:*:*:*:*",
        "cpe:2.3:a:grafana:grafana:11.6.14:security01:*:*:*:*:*:*",
        "cpe:2.3:a:grafana:grafana:12.2.8:-:*:*:*:*:*:*",
        "cpe:2.3:a:grafana:grafana:12.2.8:security01:*:*:*:*:*:*",
        "cpe:2.3:a:grafana:grafana:12.3.6:-:*:*:*:*:*:*",
        "cpe:2.3:a:grafana:grafana:12.3.6:security01:*:*:*:*:*:*",
        "cpe:2.3:a:grafana:grafana:12.4.3:-:*:*:*:*:*:*",
        "cpe:2.3:a:grafana:grafana:13.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:grafana:grafana:13.0.1:-:*:*:*:*:*:*"
    ]
}

Affected versions

pkg/promlib/v0.*

pkg/promlib/v0.0.1

pkg/promlib/v0.0.2

pkg/promlib/v0.0.3

pkg/promlib/v0.0.4

pkg/promlib/v0.0.5

pkg/promlib/v0.0.6

pkg/promlib/v0.0.7

pkg/promlib/v0.0.8

pkg/promlib/v0.0.9

pkg/util/xorm/v0.*

pkg/util/xorm/v0.0.1

v0.*

v0.0.0-cloud

v0.0.1-test

v1.*

v1.0.1

v1.0.2

v1.0.3

v1.0.4

v1.1.0

v1.2.0

v1.3.0

v1.4.0

v1.5.0

v1.5.1

v1.5.2

v1.5.3

v1.5.4

v1.6.0

v1.6.1

v1.7.0-rc1

v1.9.0

v1.9.0-rc1

v1.9.1

v10.*

v10.0.0-preview

v11.*

v11.6.0

v11.6.10

v11.6.11

v11.6.12

v11.6.13

v11.6.2

v11.6.4

v11.6.5

v11.6.6

v11.6.7

v11.6.8

v11.6.9

v12.*

v12.2.1

v12.2.2

v12.2.3

v12.2.4

v12.2.5

v12.2.6

v12.2.7

v12.3.1

v12.3.2

v12.3.3

v12.3.4

v12.3.5

v12.4.1

v12.4.2

v2.*

v2.0.0-beta1

v2.0.0-beta3

v2.0.1

v2.0.2

v2.5.0

v2.6.0

v2.6.0-beta1

v3.*

v3.0.0-beta6

v3.0.0-beta7

v3.0.1

v3.0.2

v3.1.0-beta1

v3.2.1-test

v4.*

v4.4.0

v4.5.0

v4.5.0-beta1

v4.6.0-beta1

v5.*

v5.,2.4

v5.0.0

v5.0.0-beta1

v5.0.0-beta2

v5.0.0-beta3

v5.0.0-beta4

v5.0.0-beta5

v6.*

v6.0.0-beta1

v6.5

v8.*

v8.3.3

v8.4.0-beta1

v8.5.16

v9.*

v9.3.0-beta1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-28383.json"