7.5
Élevée
CVE-2026-21720 Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image
Description
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| grafana/grafana-enterprise 3.0 | 3.0.0 → < 12.3.1 | 12.3.1 |
| grafana/grafana 3.0 | 3.0.0 → < 12.3.1 | 12.3.1 |
| Red Hat Ceph Storage 7 | Versions non publiées | |
| Red Hat Ceph Storage 8 | Versions non publiées | |
| Red Hat Enterprise Linux 10 | Versions non publiées | |
| Red Hat Enterprise Linux 8 | Versions non publiées | |
| Red Hat Enterprise Linux 9 | Versions non publiées |
Références
- grafana.com grafana.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de grafana/grafana-enterprise
Les 4 CVE de grafana/grafana-enterprise →
CVE-2025-41117
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the…
6.8
Moyenne
CVE-2026-21722
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the…
5.3
Moyenne
CVE-2026-21721
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:*…
8.1
Élevée