7.5
High
CVE-2026-21720 Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image
Description
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| grafana/grafana-enterprise 3.0 | 3.0.0 → < 12.3.1 | 12.3.1 |
| grafana/grafana 3.0 | 3.0.0 → < 12.3.1 | 12.3.1 |
| Red Hat Ceph Storage 7 | Versions not published | |
| Red Hat Ceph Storage 8 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published |
Other CVEs of grafana/grafana-enterprise
The 4 CVEs of grafana/grafana-enterprise →
CVE-2025-41117
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the…
6.8
Medium
CVE-2026-21722
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the…
5.3
Medium
CVE-2026-21721
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:*…
8.1
High