The vulnerability exists in the OpenFeature feature toggle evaluation endpoint of Grafana. When the endpoint receives data, it reads input values without imposing limits, allocating memory proportional to the received size. An attacker can send an excessively large payload, causing the process to consume excessive memory and crash due to out‑of‑memory. The primary impact is a denial‑of‑service that can disrupt the availability of a Grafana instance, owing to the weakness in input validation and resource exhaustion.

Grafana’s OpenFeature feature toggle evaluation API is affected. The CNA lists only the vendor and product; no specific version range is provided. Administrators should review the installed Grafana versions for susceptibility, especially those including the OpenFeature endpoint, and ensure they are updated to a version that limits input size or otherwise fixes the memory handling.

The CVSS base score of 7.5 indicates moderate to high severity. The exploitability score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly available exploits yet. Nonetheless, the attack vector can be remote via the HTTP API, requiring network access to the Grafana server. Because the flaw leads to an out‑of‑memory condition rather than code execution, the risk is primarily availability rather than confidentiality or integrity.