CVE-2026-33374: CWE-770 in Grafana Grafana Enterprise

The Prometheus rule conversion API endpoints in Grafana Enterprise versions >=12.0.0 <=12.3.11, >=12.4.0 <12.4.13, >=13.0.0 <13.0.11, >=13.1.0 <13.1.8, and >=13.2.0 <13.2.4 do not impose limits on the size of the request body. This allows authenticated users to trigger unbounded memory allocations, potentially causing the server to exhaust memory and crash. The vulnerability is identified as CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption), and CWE-789 (Uncontrolled Memory Allocation). The CVSS v3.1 base score is 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, and high impact on availability.

An authenticated user can exploit this vulnerability to cause the Grafana Enterprise server to consume excessive memory, leading to out-of-memory conditions and server crashes. This impacts the availability of the service but does not affect confidentiality or integrity of data. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to the Prometheus rule conversion API endpoints and monitor for unusual memory usage patterns. Avoid sending large request bodies to these endpoints.