CVE-2026-21728CWE-400CWE-770denial-of-service

CVE-2026-21728

High · published April 24, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
49.9
In the wild
Unconfirmed
What it is

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.

Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00637 · 49.9th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-04-24T13:16Z
Affected products (3)
ProductVersionsFixed in
grafana/tempo≥ 1.3.0, < 2.8.42.8.4
grafana/tempo≥ 2.9.0, < 2.9.22.9.2
grafana/tempo≥ 2.10.0, < 2.10.22.10.2
References (9)
EPSS history
Timeline
  • 24 APR 08:00Z
    Tempo query limit results in unbounded memory allocation
    cvelistv5