The Prometheus rule conversion API in Grafana accepts request bodies without size throttling. This flaw enables an authenticated user to submit a data payload that drives the system to allocate an unbounded amount of memory, eventually exhausting memory resources and causing the server to terminate. The primary consequence is a denial‑of‑service for all users of the affected Grafana instance.

Any Grafana Enterprise or Grafana OSS deployment that exposes the Prometheus rule conversion endpoints can be impacted. No specific affected product versions are listed in the advisory, so all installations before a future patch are potentially vulnerable.

With a CVSS score of 6.5 the vulnerability is of moderate severity. The EPSS score is not available, and the issue is not currently listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. However the attack requires authentication, so an attacker who has legitimate user access could trigger the failure. In environments where the API is exposed to untrusted users, the risk is higher due to potential internal compromise. The lack of a public exploit keeps the immediate threat lower, but the possibility of an internal attacker or compromised credential makes remediation important.