{"id":"CVE-2026-33374","title":"The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.","summary":"The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400","CWE-770","CWE-789"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","affected":["multicluster_global_hub","advanced_cluster_management_for_kubernetes 2","ceph_storage 7","ceph_storage 8","ceph_storage 9","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","hardened_images"],"patched":["hardened_images"],"published":"2026-10-13","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:02:37.630","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33374","references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-33374","label":"security@grafana.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33374.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-33374"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550703"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33374"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33374"},{"url":"https://access.redhat.com/errata/RHSA-2026:84422"},{"url":"https://access.redhat.com/errata/RHSA-2026:85544"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00368,"epssPercentile":0.30441,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-13T17:25:44.714882Z"},"ingestedAt":"2026-10-13T18:41:42.743Z","slug":"CVE-2026-33374","body":"## Overview\n\nThe Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, Red Hat Enterprise Linux 10, … · no fix planned: Red Hat Ceph Storage 9, Red Hat Enterprise Linux 9, Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33374.json)\n- **RHSA-2026:84422** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:84422)\n- **RHSA-2026:85544** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85544)","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}