This vulnerability in Grafana Tempo (Enterprise Traces) version 2.6.1 arises from handling TraceQL queries with large exemplars hint values. When such a query is processed, the Tempo instance may allocate an excessive amount of memory, resulting in an out-of-memory crash. The impact is a denial of service condition triggered by an authenticated user. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. There is no indication of confidentiality or integrity impact. No official patch or remediation level has been provided by the vendor as of the published date.

An authenticated user can cause the Grafana Tempo service to crash due to out-of-memory conditions triggered by specially crafted TraceQL queries with large exemplars hint values. This results in denial of service, disrupting the availability of the Tempo tracing service. There is no reported impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit access to authenticated users and monitor query usage to prevent large exemplars hint values that could trigger excessive memory allocation. No official remediation or temporary fix has been documented by the vendor.