{"id":"GHSA-p4r4-xvrq-gvmc","revision":"5cc4f2adfee94d83b6deb16397c8a7b3","records":[{"revision":"5cc4f2adfee94d83b6deb16397c8a7b3","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-p4r4-xvrq-gvmc","aliases":["CVE-2026-21728","GO-2026-5528"],"title":"Grafana Tempo has an Uncontrolled Resource Consumption issue","description":"Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.\n\nMitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18).","state":0,"publishedAt":"2026-04-24T09:30:30+00:00","modifiedAt":"2026-09-10T03:50:44.808071+00:00","affected":[{"ecosystem":"Go","name":"github.com/grafana/tempo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.3.0"},{"kind":"fixed","version":"2.8.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/grafana/tempo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.9.0"},{"kind":"fixed","version":"2.9.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/grafana/tempo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.10.0"},{"kind":"fixed","version":"2.10.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-21728","https://github.com/grafana/tempo/pull/6525","https://github.com/grafana/tempo/commit/650eb1985a0776789c8564122990f588a742356f","https://github.com/grafana/tempo","https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-10.md?plain=1#L328","https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-8.md?plain=1#L251","https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-9.md?plain=1#L224","https://grafana.com/security/security-advisories/cve-2026-21728"],"sourceUrl":"https://github.com/advisories/GHSA-p4r4-xvrq-gvmc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-p4r4-xvrq-gvmc","identifiers":["GHSA-p4r4-xvrq-gvmc","CVE-2026-21728","GO-2026-5528"]},"retained":false,"historicalAffected":[]}],"coverage":[]}