CVE-2026-33374EPSS p29.0%

CVE-2026-33374CVE-2026-33374

Description

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

Scoring

CVSS 6.5 ()
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS0.37% probability of exploitation · percentile 29.0% · 2026-10-17T12:00:28Z
Last modified2026-10-16
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.