# CVE-2026-33382: Denial of service via unbounded request body size

> CVE-2026-33382: Denial of service via unbounded request body size. CVSS 7.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-33382
Last updated: 2026-10-25T15:10:00Z

- Published: 2026-07-10 14:58 UTC · Updated: 2026-10-25 15:10 UTC · Assigner: GRAFANA
- CVSS: 7.5 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS: 0.39%, 33th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-400

## Description

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

## Affected vendors and products

- Grafana: Grafana OSS

## Tracked companies

- [Grafana Cloud](https://rewindex.com/company/grafana-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-33382)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-33382)
- [https://grafana.com/security/security-advisories/cve-2026-33382](https://grafana.com/security/security-advisories/cve-2026-33382)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-33382 · Markdown: https://rewindex.com/cve/CVE-2026-33382.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-33382 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:06.294Z