Grafana’s public dashboard query endpoint fails to impose a limit on the size of the request body before processing it. An unauthenticated attacker can send a JSON payload of arbitrary size, causing the server to allocate large amounts of memory and eventually exhaust available resources, resulting in a denial of service. The weakness relies on inadequate resource control and can affect both Grafana Enterprise and Grafana OSS installations. The impact is a loss of availability for any client that sends a large payload, potentially affecting all users sharing the same hosting environment.

The vulnerability is disclosed for Grafana Enterprise and Grafana OSS. No specific version numbers are provided in the release notes or advisory, so all currently running instances may be susceptible until a patched release is applied.

The CVSS score of 7.5 classifies this issue as high severity, indicating that a successful exploit can cause significant disruption. While the EPSS score is not reported, the lack of an authentication requirement and the possibility of triggering memory exhaustion remotely increase the likelihood of exploitation in an open or misconfigured environment. The vulnerability is not currently listed in CISA’s KEV catalog, but due to its high impact it should be treated with priority. It can be exploited simply by targeting the public dashboard query URL with a crafted request, meaning the attack surface is wide and requires no special privileges.