En bref
- CVE-2026-27878 est une vulnérabilité MOYENNE (CVSS 6.5) touchant github.com/grafana/tempo, tempo (grafana).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.41%, plus élevée que 35.4% des vulnérabilités.
- Correctif : mettre à jour vers 1.5.1-0.20260303204923-b13f74291d48, 2.10.2, 2.8.4, 2.9.2 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| github.com/grafana/tempo Go | < 1.5.1-0.20260303204923-b13f74291d48
| 1.5.1-0.20260303204923-b13f74291d48
|
| tempo | ≥ 2.10.0, < 2.10.2≥ 2.6.0, < 2.8.4≥ 2.9.0, < 2.9.2
| 2.10.22.8.42.9.2
|
Description
A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.
NVD description
A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.
Autres vulnérabilités de github.com/grafana/tempo
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free