---
id: CVE-2026-33374
title: >-
  The Prometheus rule conversion API endpoints in Grafana do not limit request
  body size, allowing authenticated users to trigger unbounded memory
  allocations that can crash the server through out-of-memory conditions.
summary: >-
  The Prometheus rule conversion API endpoints in Grafana do not limit request
  body size, allowing authenticated users to trigger unbounded memory
  allocations that can crash the server through out-of-memory conditions.
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
  - CWE-770
  - CWE-789
vendor: Red Hat
product: Red Hat Enterprise Linux 8
affected:
  - multicluster_global_hub
  - advanced_cluster_management_for_kubernetes 2
  - ceph_storage 7
  - ceph_storage 8
  - ceph_storage 9
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
  - hardened_images
patched:
  - hardened_images
published: '2026-10-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:02:37.630'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33374'
references:
  - url: 'https://grafana.com/security/security-advisories/cve-2026-33374'
    label: security@grafana.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33374.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-33374'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2550703'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-33374'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33374'
  - url: 'https://access.redhat.com/errata/RHSA-2026:84422'
  - url: 'https://access.redhat.com/errata/RHSA-2026:85544'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00368
epssPercentile: 0.30441
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T17:25:44.714882Z'
ingestedAt: '2026-10-13T18:41:42.743Z'
---

## Overview

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, Red Hat Enterprise Linux 10, … · no fix planned: Red Hat Ceph Storage 9, Red Hat Enterprise Linux 9, Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33374.json)
- **RHSA-2026:84422** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:84422)
- **RHSA-2026:85544** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85544)