Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-33378
PUBLISHED
More InfoOfficial Page
Assigner-GRAFANA
Assigner Org ID-57da9224-a3e2-4646-9d0e-c4dc2e05e7da
View Known Exploited Vulnerability (KEV) details
Published At-13 May, 2026 | 19:28
Updated At-14 May, 2026 | 12:33
Rejected At-
▼CVE Numbering Authority (CNA)
Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro

Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.

Affected Products
Vendor
Grafana LabsGrafana
Product
Grafana OSS
Platforms
  • OnPrem
Default Status
unaffected
Versions
Affected
  • From 8.0.0 through 11.6.14 (semver)
  • From 11.6.14 before 11.6.14+security-04 (custom)
  • From 12.0.0 through 12.2.8 (semver)
  • From 12.2.8 before 12.2.8+security-04 (custom)
  • From 12.3.0 through 12.3.6 (semver)
  • From 12.3.6 before 12.3.6+security-04 (custom)
  • From 12.4.0 through 12.4.3 (semver)
  • From 12.4.3 before 12.4.3+security-02 (custom)
  • From 13.0.0 through 13.0.1 (semver)
  • From 13.0.1 before 13.0.1+security-01 (custom)
Metrics
VersionBase scoreBase severityVector
3.16.5MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Version: 3.1
Base score: 6.5
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://grafana.com/security/security-advisories/cve-2026-33378
vendor-advisory
Hyperlink: https://grafana.com/security/security-advisories/cve-2026-33378
Resource:
vendor-advisory
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Problem Types
TypeCWE IDDescription
CWECWE-400CWE-400 Uncontrolled Resource Consumption
Type: CWE
CWE ID: CWE-400
Description: CWE-400 Uncontrolled Resource Consumption
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found