A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user may exploit this to trigger an out‑of‑memory condition, potentially leading to a denial of service on the affected system. The vulnerability allows an authenticated user to deliberately consume all available memory, causing the Grafana process to terminate or become unresponsive.

The affected product is Grafana OSS. No specific version range is provided in the advisory, so the issue may affect all versions of the open‑source Grafana platform until a patch is applied.

The CVSS score of 6.5 places this issue in the medium severity range. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that the likely attack vector is network‑based, requiring an authenticated user to send a large request to the plugin resources endpoint. Exploitation requires only that the attacker has valid credentials to the Grafana deployment; no privilege escalation or additional system access is required.