In Grafana Enterprise 3.0.0, the handling of /avatar/:hash requests involves spawning a goroutine to refresh Gravatar images. If the refresh task waits longer than three seconds in a 10-slot worker queue, the HTTP handler times out and stops listening, causing the goroutine to block indefinitely on an unbuffered channel. Continuous requests with random hashes cause the number of blocked goroutines to grow linearly, eventually exhausting system memory and crashing Grafana. This is a resource exhaustion vulnerability classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-703 (Improper Check or Handling of Exceptional Conditions).

The vulnerability results in a denial of service condition by exhausting memory resources due to blocked goroutines. It does not affect confidentiality or integrity but can cause Grafana to crash under sustained attack traffic, impacting availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official patch or fix information provided at this time. Until a fix is available, users should consider limiting or filtering traffic to the /avatar/:hash endpoint to mitigate potential exploitation.