Every uncached /avatar/:hash request spawns a goroutine that attempts to refresh the Gravatar image. If the request times out while queued, the goroutine blocks forever on an unbuffered channel, leaking goroutine resources. Sustained traffic with random hashes repeatedly triggers this scenario, causing the goroutine count to grow until memory is exhausted and Grafana terminates. The flaw permits an unauthenticated attacker to exhaust server resources, leading to application crashes.

Grafana’s open‑source Grafana product and its Grafana Enterprise edition are affected. The issue is present in at least version 12.3.0, as indicated by the CPE strings, and applies to all subsequent releases until a patch is applied.

With a CVSS score of 7.5, the vulnerability is of medium‑high severity. The EPSS score (<1%) suggests a low probability of exploitation at present, and the flaw has not yet been recorded in CISA’s KEV catalog. Attackers can exploit it by sending unauthenticated /avatar/:hash requests from any host that can reach Grafana, potentially from externally exposed services. Successful exploitation leads to resource exhaustion and denial of service.