Vulnerability-Lookup

GHSA-M4RJ-Q4PH-FR4V

Vulnerability from github – Published: 2026-01-27 09:30 – Updated: 2026-01-27 09:30

Details

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-21720"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-27T09:15:48Z",
    "severity": "HIGH"
  },
  "details": "Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.",
  "id": "GHSA-m4rj-q4ph-fr4v",
  "modified": "2026-01-27T09:30:29Z",
  "published": "2026-01-27T09:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21720"
    },
    {
      "type": "WEB",
      "url": "https://grafana.com/security/security-advisories/CVE-2026-21720"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-21720 (GCVE-0-2026-21720)

Vulnerability from cvelistv5 – Published: 2026-01-27 09:07 – Updated: 2026-01-27 14:29

Title

Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out

Summary

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-703 - Improper Check or Handling of Exceptional Conditions

Assigner

GRAFANA

References

URL

Tags

https://grafana.com/security/security-advisories/…

vendor-advisory

Impacted products

Vendor

Product

Version

Grafana

grafana/grafana-enterprise

Affected: 3.0.0 , < 11.6.9 (semver)

Grafana	grafana/grafana-enterprise	Affected: 3.0.0 , < 12.0.8 (semver)
Grafana	grafana/grafana-enterprise	Affected: 3.0.0 , < 12.1.5 (semver)
Grafana	grafana/grafana	Affected: 3.0.0 , < 11.6.9 (semver)
Grafana	grafana/grafana	Affected: 3.0.0 , < 12.0.8 (semver)
Grafana	grafana/grafana	Affected: 3.0.0 , < 12.1.5 (semver)
Grafana	grafana/grafana-enterprise	Affected: 3.0.0 , < 12.2.3 (semver)
Grafana	grafana/grafana	Affected: 3.0.0 , < 12.2.3 (semver)
Grafana	grafana/grafana-enterprise	Affected: 3.0.0 , < 12.3.1 (semver)
Grafana	grafana/grafana	Affected: 3.0.0 , < 12.3.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21720",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T14:28:02.795937Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-703",
                "description": "CWE-703 Improper Check or Handling of Exceptional Conditions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-27T14:29:08.671Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "grafana/grafana-enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "11.6.9",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "grafana/grafana-enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "12.0.8",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "grafana/grafana-enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "12.1.5",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "grafana/grafana",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "11.6.9",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "grafana/grafana",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "12.0.8",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "grafana/grafana",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "12.1.5",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "grafana/grafana-enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "12.2.3",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "grafana/grafana",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "12.2.3",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "grafana/grafana-enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "12.3.1",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "grafana/grafana",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "12.3.1",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-01-27T09:03:09.893Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "type": "text/markdown",
              "value": "Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems."
            }
          ],
          "value": "Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-27T09:07:04.758Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/CVE-2026-21720"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-21720",
    "datePublished": "2026-01-27T09:07:04.758Z",
    "dateReserved": "2026-01-05T09:26:06.214Z",
    "dateUpdated": "2026-01-27T14:29:08.671Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-M4RJ-Q4PH-FR4V

CVE-2026-21720 (GCVE-0-2026-21720)

Tags

Sightings

Nomenclature