| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/grafana/tempo | ≥ 1.3.0, < 2.8.4≥ 1.3.0≥ 2.10.0, < 2.10.2≥ 2.9.0, < 2.9.2 | 2.8.42.10.22.9.2 |
| tempo | ≥ 1.3.0, < 2.8.4≥ 2.10.0, < 2.10.2≥ 2.9.0, < 2.9.2 | 2.8.42.10.22.9.2 |
Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.
Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free