A Grafana testdata datasource can be leveraged to trigger out‑of‑memory conditions, causing the Grafana application to crash or become unresponsive. The vulnerability results from the datasource's unbounded memory allocation capability, which—when invoked—exceeds available system memory and forces the process to terminate. This effectively denies legitimate users the ability to use Grafana until it is restarted, compromising availability and potentially interrupting dashboards, alerts, and user sessions that rely on the service.

Grafana is the affected vendor and product. All releases that include the default testdata datasource are impacted until a patch or update is applied. Specific version details are not enumerated in the advisory, so any Grafana instance that has the testdata datasource enabled is considered at risk.

The CVSS score of 6.5 denotes a medium severity, reflecting the denial‑of‑service potential without granting direct access to secrets or data. The exploit probability (EPSS) is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known, widely exploited instances yet. The attack vector is not explicitly detailed; however, it is inferred that an attacker would need the ability to configure or trigger the testdata datasource, which may require authenticated access or public endpoints if exposed. Given the moderate severity and lack of known exploitation, the risk remains noteworthy, especially in environments with high availability requirements.