CVE-2026-33374 — Unbounded memory allocation in the Prometheus rule conversion API
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the s…
Published: 2026-10-13 · CVSS: 6.5 · CVSS 3.1
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7