The vulnerability in Grafana Enterprise's public dashboard query endpoint arises from the lack of request body size limitation before processing. An unauthenticated attacker can exploit this by sending very large JSON payloads, triggering excessive memory allocation on the server. This can result in denial of service conditions due to memory exhaustion. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting high severity with network attack vector, no privileges or user interaction required, and impact limited to availability. No vendor advisory or patch information is currently available, and the affected versions are not explicitly stated.

Successful exploitation leads to denial of service through memory exhaustion on the Grafana Enterprise server. The availability of the service can be disrupted without requiring authentication or valid access tokens. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing network-level protections such as rate limiting or request size restrictions on the Grafana Enterprise public dashboard query endpoint to mitigate potential abuse.