The OpenFeature evaluation API in Grafana versions >=12.1.0 <12.1.10, >=12.2.0 <12.2.8, >=12.3.0 <12.3.6, and >=12.4.0 <12.4.2 reads input data without bounds into memory. This unbounded read can cause the application to consume excessive memory, leading to out-of-memory crashes. The vulnerability is categorized as high severity due to its potential to disrupt service availability. No CVSS score or explicit patch information is provided in the available data. The vendor advisory referenced (Red Hat) does not contain explicit remediation details in the provided excerpt.

Successful exploitation of this vulnerability can cause Grafana to crash due to out-of-memory conditions, resulting in denial of service. There is no indication of code execution or data leakage. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch or workaround is provided in the available vendor advisory content, users should monitor official Grafana and Red Hat advisories for updates. Until a fix is applied, consider limiting input sizes or applying resource limits to mitigate potential crashes.