PT-2026-4877 · Grafana+1 · Grafana+1

Published

2026-01-27

·

Updated

2026-04-22

·

CVE-2026-21720

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions Grafana (affected versions not specified)
Description The software can crash due to a memory exhaustion issue triggered by uncached requests to the /avatar/:hash endpoint. Each request spawns a goroutine to refresh the Gravatar image. If this process takes longer than three seconds, the handler times out, causing the goroutine to block indefinitely while attempting to send data on an unbuffered channel. Sustained traffic with random hashes exacerbates this issue, leading to a linear increase in goroutine count and eventual memory exhaustion, resulting in a crash. The hash variable within the /avatar/:hash API endpoint is a key factor in triggering this behavior.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

Related Identifiers

BDU:2026-03572
BIT-GRAFANA-2026-21720
CVE-2026-21720
OPENSUSE-SU-2026:10601-1
OPENSUSE-SU-2026:20654-1
SUSE-SU-2026:1013-1
SUSE-SU-2026:1037-1
SUSE-SU-2026:1524-1

Affected Products

Grafana
Red Os