{"cve":"CVE-2026-42127","nvd":{"published":"2026-06-22T18:16:37.430","modified":"2026-07-10T16:16:30.967","status":"Modified","description":"The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400","CWE-770"],"references":["https://grafana.com/security/security-advisories/cve-2026-42127"],"products":["grafana:grafana"],"source":"nvd","synced_at":"2026-10-19T22:39:28.638635428+00:00"},"epss":{"cve":"CVE-2026-42127","score":0.00432,"percentile":0.37565,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-3w66-95m3-8jxg","url":"https://osv.dev/vulnerability/GHSA-3w66-95m3-8jxg","summary":"Grafana: Pre-authentication denial of service in the public dashboard query handler","modified":"2026-09-28T17:10:47.965467801Z","packages":[{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":[">=2.0.0-beta1"],"fixed":[]},{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":[">=12.0.0"],"fixed":[]},{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":[">=12.3.0"],"fixed":[]},{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":[">=12.4.0"],"fixed":[]},{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":[">=13.0.0"],"fixed":[]},{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":["<1.9.2-0.20260616075434-82ef13993059"],"fixed":["1.9.2-0.20260616075434-82ef13993059"]}]},{"id":"GO-2026-6541","url":"https://osv.dev/vulnerability/GO-2026-6541","summary":"Grafana: Pre-authentication denial of service in the public dashboard query handler in github.com/grafana/grafana","modified":"2026-09-28T17:10:47.965467801Z","packages":[{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":[">=2.0.0-beta1+incompatible"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}