This vulnerability in Grafana OSS arises from the plugin resources endpoint reading the entire request body into memory without bounds. An authenticated user can exploit this behavior to trigger excessive memory consumption, potentially causing the application to run out of memory and crash or become unresponsive. The CVSS v3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No patch or official fix has been confirmed as of the published date.

Exploitation of this vulnerability can cause a denial of service by exhausting server memory resources. There is no impact on confidentiality or integrity reported. The attack requires an authenticated user, limiting the attack surface to those with valid credentials. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin resources endpoint to trusted authenticated users only and monitor resource usage to detect potential exploitation attempts.