CVE-2026-27878 json
Tempo TraceQL query with exemplar hint could result in unbounded memory usage
published 2026-06-19 4 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-38066 , GHSA-6xff-cpcq-vpw2 , GO-2026-6325
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 35%
- public exploits
- 0
- none known
Summary
A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.
Patch / fix
- go github.com/grafana/tempo 1.5.1-0.20260303204923-b13f74291d48
- Grafana Enterprise Traces (GET) 2.8.8
- Grafana Tempo 2.10.2
- govulncheck-vulndb SLES 16.0, SLES for SAP applications 16.0 0.0.20260902T191204-160000.1.1
suse advisories SUSE-SU-2026:23692-1SUSE-SU-2026:23712-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260902T191204-160000.1.1
opensuse advisories openSUSE-SU-2026:21812-1
- github.com/grafana/tempo@3d7c78d commit
- github.com/grafana/tempo@b13f742 commit
- github.com/grafana/tempo@b481ae9 commit
- github.com/grafana/tempo@e2d51b7 commit
- github.com/grafana/tempo#6559 pull request
- github.com/grafana/tempo#6646 pull request
- github.com/grafana/tempo#6792 pull request
- github.com/grafana/tempo#6802 pull request
- github.com/grafana/tempo/releases/tag/v2.10.2 release
- github.com/grafana/tempo/releases/tag/v2.8.4 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/grafana/tempo | <1.5.1-0.20260303204923-b13f74291d48 |
1.5.1-0.20260303204923-b13f74291d48 |
Affected products
- Grafana Enterprise Traces (GET)
- Grafana Tempo
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/grafana/tempo/pull/6559
web, patch
-
github.com
/grafana/tempo/pull/6646
web, patch
-
github.com
/grafana/tempo/pull/6792
web, patch
-
github.com
/grafana/tempo/pull/6802
web, patch
-
github.com
/grafana/tempo/commit/3d7c78d438890991df594c20ae2031f8934aba3b
web, patch
-
github.com
/grafana/tempo/commit/b13f74291d489672601a10297f8fbcbf7dd19192
web, patch
-
github.com
/grafana/tempo/commit/b481ae9693f99785691197915066e6306950fa09
web, patch
-
github.com
/grafana/tempo/commit/e2d51b786aff94de3319c07994c6a5539b121eb5
web, patch
-
grafana.com
/security/security-advisories/cve-2026-27878
vendor-advisory, web, broken-link
-
nvd.nist.gov
/vuln/detail/CVE-2026-27878
advisory
-
github.com
/grafana/tempo
package
-
github.com
/grafana/tempo/releases/tag/v2.10.2
web
-
github.com
/grafana/tempo/releases/tag/v2.8.4
web
-
github.com
/grafana/tempo/releases/tag/v2.9.2
web
-
github.com
/advisories/GHSA-6xff-cpcq-vpw2
advisory
Sources
- CVE List CVE-2026-27878
- GitHub Advisory GHSA-6xff-cpcq-vpw2
- NVD CVE-2026-27878
- OSV GO-2026-6325
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.