The vulnerability in Grafana Tempo (CVE-2026-21728) arises from the service processing queries with large limits, which can cause excessive memory allocations. This resource exhaustion can degrade or disrupt service availability, constituting a denial of service (DoS) condition. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The CVSS v3.1 base score is 7.5 (high), reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact on availability. Mitigation can be achieved by configuring max_result_limit in the search config or by restarting the service automatically. Red Hat advisories reference this vulnerability and provide updates for affected products, but no explicit official fix or patch is documented in the provided advisory content.

Exploitation of this vulnerability allows a remote attacker to cause excessive memory consumption on the Tempo service by sending queries with large limits. This can lead to denial of service by impacting the availability of the service. There is no impact on confidentiality or integrity. The vulnerability affects service availability, potentially causing service disruption.

Currently, no official patch or fix is confirmed by the vendor. Mitigation can be implemented by setting the max_result_limit parameter in the Tempo search configuration to limit the size of queries, for example to 262144 (2^18). Alternatively, configuring the service to automatically restart can help recover from resource exhaustion. Users should monitor vendor advisories for any forthcoming official fixes or updates. Red Hat has issued security advisories referencing this CVE and recommends applying updates when available.