This vulnerability in Grafana Enterprise 3.0.0 arises from the handling of uncached /avatar/:hash requests. Each such request spawns a goroutine to refresh the Gravatar image. If the refresh operation sits in a limited worker queue longer than three seconds, the handler times out and stops listening for the result, causing the goroutine to block indefinitely while trying to send on an unbuffered channel. Continuous traffic with random hashes triggers repeated timeouts, causing the number of blocked goroutines to increase linearly, leading to memory exhaustion and potential Grafana crashes. The vulnerability affects Grafana instances shipped with Red Hat Ceph Storage, Red Hat Enterprise Linux, and Red Hat In-Vehicle OS. The CVSS v3.1 score is 7.5 (high severity) with no confidentiality or integrity impact but high availability impact. No known exploits in the wild have been reported. The vendor advisory recommends disabling Gravatar support by setting 'allow_gravatar = false' in the grafana.ini configuration file and restarting the service to mitigate the issue.

An unauthenticated remote attacker can cause a denial of service by exhausting system memory through sustained requests to the /avatar/:hash endpoint. This resource exhaustion leads to Grafana service crashes, impacting availability. There is no impact on confidentiality or integrity.

A fix is not explicitly stated as available. The vendor advisory from Red Hat recommends mitigating this vulnerability by disabling Gravatar support in the Grafana configuration. This is done by editing the 'grafana.ini' file to set 'allow_gravatar = false' under the [users] section and restarting the Grafana service. This mitigation prevents user avatars from being displayed but stops the resource exhaustion issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.