Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-21720
PUBLISHED
More InfoOfficial Page
Assigner-GRAFANA
Assigner Org ID-57da9224-a3e2-4646-9d0e-c4dc2e05e7da
View Known Exploited Vulnerability (KEV) details
Published At-27 Jan, 2026 | 09:07
Updated At-12 Feb, 2026 | 13:00
Rejected At-
▼CVE Numbering Authority (CNA)
Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.

Affected Products
Vendor
Grafana LabsGrafana
Product
grafana/grafana-enterprise
Default Status
unaffected
Versions
Affected
  • From 3.0.0 before 11.6.9 (semver)
Vendor
Grafana LabsGrafana
Product
grafana/grafana-enterprise
Default Status
unaffected
Versions
Affected
  • From 3.0.0 before 12.0.8 (semver)
Vendor
Grafana LabsGrafana
Product
grafana/grafana-enterprise
Default Status
unaffected
Versions
Affected
  • From 3.0.0 before 12.1.5 (semver)
Vendor
Grafana LabsGrafana
Product
grafana/grafana
Default Status
unaffected
Versions
Affected
  • From 3.0.0 before 11.6.9 (semver)
Vendor
Grafana LabsGrafana
Product
grafana/grafana
Default Status
unaffected
Versions
Affected
  • From 3.0.0 before 12.0.8 (semver)
Vendor
Grafana LabsGrafana
Product
grafana/grafana
Default Status
unaffected
Versions
Affected
  • From 3.0.0 before 12.1.5 (semver)
Vendor
Grafana LabsGrafana
Product
grafana/grafana-enterprise
Default Status
unaffected
Versions
Affected
  • From 3.0.0 before 12.2.3 (semver)
Vendor
Grafana LabsGrafana
Product
grafana/grafana
Default Status
unaffected
Versions
Affected
  • From 3.0.0 before 12.2.3 (semver)
Vendor
Grafana LabsGrafana
Product
grafana/grafana-enterprise
Default Status
unaffected
Versions
Affected
  • From 3.0.0 before 12.3.1 (semver)
Vendor
Grafana LabsGrafana
Product
grafana/grafana
Default Status
unaffected
Versions
Affected
  • From 3.0.0 before 12.3.1 (semver)
Metrics
VersionBase scoreBase severityVector
3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://grafana.com/security/security-advisories/cve-2026-21720
vendor-advisory
Hyperlink: https://grafana.com/security/security-advisories/cve-2026-21720
Resource:
vendor-advisory
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Problem Types
TypeCWE IDDescription
CWECWE-400CWE-400 Uncontrolled Resource Consumption
CWECWE-703CWE-703 Improper Check or Handling of Exceptional Conditions
Type: CWE
CWE ID: CWE-400
Description: CWE-400 Uncontrolled Resource Consumption
Type: CWE
CWE ID: CWE-703
Description: CWE-703 Improper Check or Handling of Exceptional Conditions
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Details not found