UpHeron
All vulnerabilities

Servers and applications

CVE-2026-81843

Memory exhaustion denial of service in Elasticsearch data source index patterns

Severity
Medium 6.5
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
12.4.15
Weakness
Allocation without limits (CWE-770)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Sources
CVE Program

Description

Grafana is an open-source platform for monitoring and observability.

When an Elasticsearch data source is configured with a time-based index pattern, Grafana generated one index name for every interval in the requested query time range without any upper limit. A user with permission to query the data source, which includes users holding only the Viewer role in a default configuration, could submit a single small query with an extreme time range and cause the server to allocate memory until it was terminated. The allocation occurred before any request was sent to Elasticsearch, so the condition applied whether or not the Elasticsearch cluster was reachable.

Data sources configured with a static index name are not affected.

From the CVE Program.

Affected software

SoftwareAffected versions
GrafanaServers and applications · cna:grafana|grafana enterprise
  • From 11.6.0 up to 11.6.16
  • From 12.0.0 up to 12.2.10
  • From 12.3.0 before 12.4.15

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-81843