A testdata data‑source can trigger unbounded memory allocations within Grafana, causing out‑of‑memory crashes that lead to a denial of service. The weakness is a resource exhaustion flaw, classified as CWE‑400 (Uncontrolled Resource Consumption) and CWE‑770 (Allocation of Resources on Demand). When triggered, the application terminates, potentially impacting all users connected to the affected instance.

The vulnerability applies to Grafana, the monitoring and observability platform. Specific affected versions are not listed in the advisory; therefore, all released Grafana packages should be treated as vulnerable until a version that addresses the issue is identified.

The CVSS score of 6.5 indicates medium severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, implying no publicly known exploits at this time. The attack vector is inferred to be local or authenticated access to Grafana's configuration interface, where an attacker can create or modify a testdata datasource to produce the unbounded memory allocation. Any system that allows testdata datasources to be defined is therefore at risk.