Grafana Tempo version 1.3.0 is affected by a denial-of-service vulnerability (CVE-2026-21728) where queries specifying large result limits can trigger large memory allocations. This excessive memory use can degrade or disrupt service availability depending on deployment specifics. The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption). While no official patch or vendor remediation level is provided, the vendor suggests mitigating the issue by setting a max_result_limit in the search configuration (e.g., 262144) to cap the maximum number of results returned by queries and thus limit memory usage.

The vulnerability can cause high memory consumption leading to potential service unavailability or denial-of-service conditions in Grafana Tempo deployments. There is no impact on confidentiality or integrity reported. The severity is rated high with a CVSS score of 7.5 due to the potential for availability disruption. No known exploits have been observed in the wild.

Since no official patch or fix is currently available, it is recommended to mitigate this vulnerability by configuring the max_result_limit parameter in the Tempo search configuration to a safe value such as 262144. This limits the size of query results and prevents excessive memory allocation. Monitor vendor advisories for any future patches or updates addressing this issue.