Tempo query limit results in unbounded memory allocation

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-21728 · Microsoft / collected KEV context

EUVD-2026-25408

GHSA-p4r4-xvrq-gvmc

GO-2026-5528

cve-program · CVE-2026-21728

• https://grafana.com/security/security-advisories/cve-2026-21728

euvd · EUVD-2026-25408

• https://grafana.com/security/security-advisories/cve-2026-21728

nvd · CVE-2026-21728

• https://grafana.com/security/security-advisories/cve-2026-21728
• https://access.redhat.com/errata/RHSA-2026:21769
• https://access.redhat.com/errata/RHSA-2026:22347
• https://access.redhat.com/errata/RHSA-2026:22423
• https://access.redhat.com/errata/RHSA-2026:23345
• https://access.redhat.com/errata/RHSA-2026:24503
• https://access.redhat.com/security/cve/CVE-2026-21728
• https://bugzilla.redhat.com/show_bug.cgi?id=2461395
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21728.json

osv · GHSA-p4r4-xvrq-gvmc

• https://nvd.nist.gov/vuln/detail/CVE-2026-21728
• https://github.com/grafana/tempo/pull/6525
• https://github.com/grafana/tempo/commit/650eb1985a0776789c8564122990f588a742356f
• https://github.com/grafana/tempo
• https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-10.md?plain=1#L328
• https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-8.md?plain=1#L251
• https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-9.md?plain=1#L224
• https://grafana.com/security/security-advisories/cve-2026-21728

osv · GO-2026-5528

• https://github.com/advisories/GHSA-p4r4-xvrq-gvmc
• https://nvd.nist.gov/vuln/detail/CVE-2026-21728
• https://github.com/grafana/tempo/commit/650eb1985a0776789c8564122990f588a742356f
• https://github.com/grafana/tempo/pull/6525
• https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-10.md?plain=1#L328
• https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-8.md?plain=1#L251
• https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-9.md?plain=1#L224

No related operational record is retained in the current change model.