Loki fails to enforce a maximum on the detected_fields query limit, allowing a user to request an arbitrarily large value. The resulting unbounded memory allocation can exhaust host resources, leading to out‑of‑memory termination or degraded performance. This flaw constitutes a denial‑of‑service vulnerability caused by uncontrolled memory usage (CWE‑770).

Grafana Loki installations that have not applied the recent security patch are vulnerable. The advisory does not list specific version numbers, so any Loki release preceding the patched version should be treated as susceptible until the fix is verified.

The CVSS score of 7.5 indicates medium‑high severity. The EPSS score of less than 1% reflects a low present exploitation likelihood, and the flaw is not listed in CISA’s KEV catalog. It is inferred that an attacker can trigger the issue by issuing a Loki query with an excessively large limit over the network, causing the server to attempt a large memory allocation that may exhaust system resources.