PT-2026-34868 · Grafana · Tempo

Published 2026-04-24 · Updated 2026-04-25 · CVE-2026-21728

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tempo (affected versions not specified)

Description Queries with large limits can cause excessive memory allocations, which may impact service availability depending on the deployment strategy.

Recommendations Set the max result limit in the search configuration, for example, to 262144 (2^18).

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-21728

GHSA-P4R4-XVRQ-GVMC

Affected Products

Tempo

References · 10

• https://osv.dev/vulnerability/GHSA-p4r4-xvrq-gvmc · Vendor Advisory
• https://grafana.com/security/security-advisories/cve-2026-21728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21728 · Security Note
• https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-10.md?plain=1#L328 · Note
• https://github.com/grafana/tempo · Note
• https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-8.md?plain=1#L251 · Note
• https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-9.md?plain=1#L224 · Note
• https://github.com/grafana/tempo/pull/6525 · Note
• https://github.com/grafana/tempo/commit/650eb1985a0776789c8564122990f588a742356f · Note
• https://twitter.com/CVEnew/status/2048099302673711379 · Twitter Post