This vulnerability involves the Grafana plugin resources endpoint reading the entire request body into memory without bounds. An authenticated attacker can exploit this behavior to trigger excessive memory consumption, potentially causing the Grafana server to run out of memory and become unavailable. The issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and causing high impact on availability but no confidentiality or integrity impact.

Successful exploitation results in a denial of service condition due to out-of-memory on the Grafana server. There is no impact on confidentiality or integrity. The attack requires authenticated access, limiting the attacker scope to users with valid credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users and monitor for unusual memory usage patterns. Avoid exposing the plugin resources endpoint to untrusted users.