CVE-2026-21729

Loki detected_fields query limits results in unbounded memory allocation

Published Jul 16, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.

Analysis

Technical impact

Loki fails to enforce a maximum on the detected_fields query limit, allowing a user to request an arbitrarily large value. The resulting unbounded memory allocation can exhaust host resources, leading to out‑of‑memory termination or degraded performance. This flaw constitutes a denial‑of‑service vulnerability caused by uncontrolled memory usage (CWE‑770).

Affected Systems

Grafana Loki installations that have not applied the recent security patch are vulnerable. The advisory does not list specific version numbers, so any Loki release preceding the patched version should be treated as susceptible until the fix is verified.

Risk and Exploitability

The CVSS score of 7.5 indicates medium‑high severity. The EPSS score of less than 1% reflects a low present exploitation likelihood, and the flaw is not listed in CISA’s KEV catalog. It is inferred that an attacker can trigger the issue by issuing a Loki query with an excessively large limit over the network, causing the server to attempt a large memory allocation that may exhaust system resources.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Grafana

Loki

unaffected

Version	Status	Constraints
`v3.0.0`	affected	< v3.7.0

No data.

Vendor Product Versions

Grafana

Loki

Version	Status	Scheme	Platform
`[v3.0.0,v3.7.0)`	affected	generic	['onprem', 'cloud']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Grafana Loki patch that implements bound checking for detected_fields queries.
Configure a safe maximum for detected_fields query limits or enforce limits through query whitelisting.
Deploy OS‑level resource constraints such as cgroups or container memory limits to cap Loki’s memory usage.
Enable monitoring and alerting for abnormal memory consumption or out‑of‑memory events to detect abuse.

Generated by OpenCVE AI on July 31, 2026 at 02:22 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.460% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://grafana.com/security/security-advisories/cve-2026-21729

History

Jul 16, 2026 1:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-770
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 16, 2026 5:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Grafana Grafana loki
Vendors & Products		Grafana Grafana loki

Jul 16, 2026 3:30 AM Description updated. Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.
Title		Loki detected_fields query limits results in unbounded memory allocation
References		https://grafana.com/security/security-advisories/cve-2026-21729
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`