Grafana Tempo version 1.3.0 is vulnerable to a denial-of-service condition caused by queries that request large result sets. Such queries lead to large memory allocations which may degrade or disrupt service availability. The vulnerability is identified as CVE-2026-21728 with a CVSS 3.1 base score of 7.5 (high severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. No official patch or remediation level is currently documented. A recommended mitigation is to set the max_result_limit configuration parameter (e.g., to 262144) to limit the size of query results and control memory consumption.

The vulnerability can cause high memory usage on affected Grafana Tempo instances, potentially leading to service unavailability or denial of service. There is no indication of confidentiality or integrity impact. The impact depends on deployment specifics and query patterns. No known exploits are reported in the wild.

No official patch or fix is currently available. Administrators should mitigate the risk by configuring the max_result_limit setting in the Tempo search configuration to a reasonable value (such as 262144) to limit the size of query results and prevent excessive memory allocation. Monitor vendor advisories for updates regarding official fixes.