Advisoriesby IbisGrafana LabsCVE-2026-8609
Grafana OSS: denial of service
No fix yet
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Grafana OSS Product | >= 11.6.0, <= 11.6.14 | No fix yet |
| >= 12.2.0, <= 12.2.8 | No fix yet | |
| >= 12.3.0, <= 12.3.6 | No fix yet | |
| >= 12.4.0, <= 12.4.3 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-400