This vulnerability in Grafana Tempo allows queries with large limits to trigger large memory allocations, which can degrade or disrupt service availability. The problem is related to resource exhaustion (CWE-400) and improper resource management (CWE-770). The CVSS 3.1 score is 7.5 (high), reflecting network attack vector, low complexity, no privileges or user interaction required, and impact on availability only. Mitigation can be achieved by setting a maximum result limit (e.g., max_result_limit=262144) in the search configuration or by automatically restarting the service to recover from memory exhaustion. Red Hat advisories mention security updates addressing this issue, but no direct patch version for Tempo is specified in the input data.

The vulnerability can cause large memory allocations during Tempo queries with large limits, potentially leading to service unavailability or denial of service conditions. There is no reported impact on confidentiality or integrity. The impact is limited to availability degradation depending on deployment strategy.

Mitigation is possible by configuring the max_result_limit parameter in the Tempo search configuration to limit the size of query results, for example setting it to 262144. Alternatively, implementing automatic service restarts can help recover from memory exhaustion. Red Hat advisories indicate security updates addressing this vulnerability; users should consult the referenced Red Hat errata for applicable patches or updates. Patch status is not explicitly confirmed in the input data; check vendor advisories for current remediation guidance.