Several Grafana OSS API endpoints lack restrictions on the size of the request body before processing. An attacker can exploit this by sending oversized payloads, forcing the application to allocate excessive memory, which may lead to memory exhaustion and denial of service. The vulnerability is identified as CWE-400 (Uncontrolled Resource Consumption). The CVSS v3.1 base score is 7.5 (high), reflecting network attack vector, no privileges or user interaction required, and an impact on availability only. No official patch or remediation level is currently provided, and no known exploits are reported in the wild. The affected versions explicitly include =11.6.0, =12.2.0, =12.3.0, =12.4.0, and =13.0.0.

Successful exploitation can cause denial of service by exhausting memory resources on the Grafana OSS server, potentially disrupting availability of the service. There is no impact on confidentiality or integrity reported. The vulnerability can be triggered remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing network-level protections such as limiting request body sizes on API endpoints to mitigate the risk of memory exhaustion. Monitor for updates from Grafana regarding patches or official mitigations.