Skip to content
Fencer Vulns
high 7.5

CVE-2026-21720 json

Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out

published 2026-01-27 9 mo ago modified 2026-08-27 2 mo ago also BIT-grafana-2026-21720 , EUVD-2026-4841

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.

Patch / fix

  • bitnami grafana 11.6.9, 12.0.8, 12.1.5, 12.2.3, 12.3.1
  • Grafana grafana/grafana-enterprise 11.6.9, 12.0.8, 12.1.5, 12.2.3, 12.3.1
  • Grafana grafana/grafana 11.6.9, 12.0.8, 12.1.5, 12.2.3, 12.3.1
  • grafana Multi Linux Manager Tools SLE-15 11.6.14+security01-150002.4.14.1
  • spacecmd Multi Linux Manager Tools SLE-15 5.1.13-150002.3.9.3
  • uyuni-tools Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 5.1.26-150002.3.12.1
  • prometheus-blackbox_exporter Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 0.26.0-150002.3.6.1
  • golang-github-prometheus-prometheus Multi Linux Manager Tools SLE-15 3.5.0-150002.3.8.1
  • golang-github-lusitaniae-apache_exporter Multi Linux Manager Tools SLE-15 1.0.10-150002.3.6.1
  • grafana SLE Module for Package Hub 15 SP7, openSUSE Leap 15.6 11.6.11-150200.3.83.1
  • grafana Manager Client Tools 15 11.6.11-150000.1.90.1

suse advisories SUSE-SU-2026:1524-1SUSE-SU-2026:1037-1SUSE-SU-2026:1013-1

  • grafana openSUSE Tumbleweed 11.6.14+security01-1.1

opensuse advisories openSUSE-SU-2026:10601-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-21720 updated cvss 7.5

grafana: Grafana: Denial of Service via resource exhaustion from avatar requests

  • Red Hat Ceph Storage 7 rhceph/grafana-rhel9 Red Hat Ceph Storage 8 rhceph/grafana-rhel9 Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat Enterprise Linux 10 grafana
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
9 mo ago

Exploit prediction

0.69% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami grafana
>=3.0.0, <11.6.9
>=12.0.0, <12.0.8
>=12.1.0, <12.1.5
>=12.2.0, <12.2.3
>=12.3.0, <12.3.1
11.6.9
12.0.8
12.1.5
12.2.3
12.3.1

Affected products

  • Grafana grafana/grafana-enterprise
  • Grafana grafana/grafana
  • Red Hat Red Hat Ceph Storage 7
  • Red Hat Red Hat Ceph Storage 8
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-703 Improper Check or Handling of Exceptional Conditions
  • CWE-772 Missing Release of Resource after Effective Lifetime

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.