Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-33378 EUVD-2026-30144GHSA-rr8q-qwrv-9pf6

Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro

Published May 13, 2026 · Updated Aug 27, 2026 · Assigned by GRAFANA

Vendor: Grafana Product: Grafana OSS Package: grafana Package: grafana-12.4 Category: Web / CMS Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.

Affected products

VendorProductAffectedFixed
Grafana Grafana OSS 8.0.0 – ≤ 11.6.14, 11.6.14 – < 11.6.14+security-04, 12.0.0 – ≤ 12.2.8, 12.2.8 – < 12.2.8+security-04, 12.3.0 – ≤ 12.3.6, 12.3.6 – < 12.3.6+security-04, 12.4.0 – ≤ 12.4.3, 12.4.3 – < 12.4.3+security-02, 13.0.0 – ≤ 13.0.1, 13.0.1 – < 13.0.1+security-01 11.6.14+security-04

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS grafana No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 grafana12.4 12.4.10-0.6.hum1 RHSA-2026:68821
Red Hat Hardened Images 1 grafana13.1 13.1.6-0.1.hum1 RHSA-2026:68767
Red Hat Hardened Images 1 grafana13.2 13.2.1-0.5.hum1 RHSA-2026:68778

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 grafana 12.4.5-150200.3.91.1 SUSE-SU-2026:3718-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Multi Linux Manager Tools SLE-Micro-5 dracut-saltboot 1.2.1-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-Micro-5 golang-github-prometheus-node_exporter 1.10.2-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-Micro-5 uyuni-tools 5.2.12-150002.3.17.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 dracut-saltboot 1.2.1-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-QubitProducts-exporter_exporter 0.4.0-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-boynux-squid_exporter 1.13.0-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-lusitaniae-apache_exporter 1.0.10-150002.3.9.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-alertmanager 0.28.1-150002.4.11.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-node_exporter 1.10.2-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-prometheus 3.5.3-150002.3.13.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 grafana 11.6.14+security04-150002.4.21.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 mgr-push 5.2.4-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 prometheus-blackbox_exporter 0.26.0-150002.3.11.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 prometheus-postgres_exporter 0.10.1-150002.3.3.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 python-defusedxml-sle15 0.7.1-150002.1.3.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 rhnlib 5.2.5-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 spacecmd 5.2.8-150002.3.12.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 spacewalk-client-tools 5.2.6-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 supportutils-plugin-salt 1.2.3-150002.3.3.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 supportutils-plugin-susemanager-client 5.2.3-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 uyuni-common-libs 5.2.5-150002.3.6.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 uyuni-tools 5.2.12-150002.3.17.1 SUSE-SU-2026:2768-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-attestation-image +3 5.1.4-8.22.10 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image +3 5.1.4-8.20.12 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-image +3 5.1.4-8.20.34 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image +3 5.1.4-8.20.13 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-postgresql-image +3 5.1.4-6.24.3 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-saline-image +3 5.1.4-9.20.24 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 uyuni-tools 5.1.29-150700.3.26.1 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-proxy-httpd-image +3 5.1.4-8.22.22 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image +3 5.1.4-9.20.25 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-proxy-squid-image +3 5.1.4-8.20.11 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-proxy-ssh-image +3 5.1.4-8.20.12 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image +3 5.1.4-8.20.13 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 uyuni-tools 5.1.29-150700.3.26.1 SUSE-SU-2026:2774-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed grafana 11.6.14+security04-1.1 openSUSE-SU-2026:10932-1
openSUSE Leap 16.0 grafana 11.6.14+security04-bp160.1.1 openSUSE-SU-2026:20940-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling grafana-12.4 12.4.3.02-r0 —

Advisories 9

References