Tempo allows users to query traces with an optional limit parameter. When a query specifies an excessively large limit, the service allocates a buffer proportional to that limit. This can exhaust available memory and cause the Tempo service to become unresponsive, leading to a denial‑of‑service attack.

The affected product is Grafana:Tempo, a distributed tracing system. No specific version information is supplied, so all known publicly available releases are potentially vulnerable until a fix is released.

The CVSS score of 7.5 indicates a medium‑to‑high severity. The EPSS score is reported as < 1%, suggesting very low exploitation probability in the wild. Tempo is not listed in CISA’s KEV catalog. The vulnerability can be exploited by sending a crafted query with a very large limit from an external interface, assuming the attacker has query execution privileges. While the attack might require access to the Tempo query endpoint, the impact is significant because it can bring the service down.