The OpenFeature evaluation endpoint in Grafana reads input data into memory without imposing any limits. This unbounded allocation can exhaust the process memory, leading to an out-of-memory crash and a denial of service for all clients relying on the API. The weakness corresponds to uncontrolled memory allocation (CWE‑770) and also exhibits characteristics of an out-of-bounds write (CWE‑787).

The flaw is present in all Grafana installations that expose the OpenFeature evaluation API. No specific version information is listed in the CVE data, so any Grafana instance that uses this endpoint is potentially affected.

The CVSS score of 7.5 reflects a moderate-to-high severity. The EPSS score of less than 1% suggests that exploitation is relatively unlikely at present, and the vulnerability is not yet listed in the CISA KEV catalog. The vulnerability can be exercised by sending a crafted request to the OpenFeature evaluation endpoint over the network, which is inferred from the nature of the API.