The Grafana Live push endpoint can allocate memory without bounds when an authenticated user sends a large or streaming request body. This uncontrolled allocation can exhaust server memory, causing the Grafana process to terminate or become unresponsive, thereby degrading availability. The flaw is a classic example of unbounded resource consumption, as captured by CWE-770.

The vulnerability affects Grafana OSS. No specific version ranges are given, so all current and previous releases of Grafana OSS should be considered potentially impacted until an official patch is released.

The CVSS score is 6.5, indicating a moderate severity. The EPSS score is 0.0004, indicating a very low exploitation probability, and the vulnerability is not listed in CISA KEV. The likely attack vector is through authenticated access to the Live API; the attacker must first have credentials and permissions within Grafana. Once authenticated, the attacker can send arbitrarily large payloads to trigger out-of-memory conditions.