Description
A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Enterprise Traces (GET) | 2.6.1 – < 2.8.8 | 2.8.8 |
| Grafana | Tempo | 2.6.0 – < 2.10.2 | 2.10.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260902T191204-160000.1.1 | SUSE-SU-2026:23712-1, SUSE-SU-2026:23692-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260902T191204-160000.1.1 | SUSE-SU-2026:23712-1, SUSE-SU-2026:23692-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260902T191204-160000.1.1 | openSUSE-SU-2026:21812-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | grafana-12.3 | No fix yet | — |
| Wolfi rolling | grafana-12.4 | 12.4.9-r4 | — |
| Wolfi rolling | grafana-13.0 | 13.0.8-r4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/grafana/tempo | < 1.5.1-0.20260303204923-b13f74291d48 | 1.5.1-0.20260303204923-b13f74291d48 | GHSA-6xff-cpcq-vpw2 |
Advisories 4
- SUSE-SU-2026:23692-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:23712-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 29, 2026
- openSUSE-SU-2026:21812-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 10, 2026
- WID-SEC-2026-2342 Grafana Tempo: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jul 14, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-27878 vendor-advisory