What is CVE-2026-33382?

CVE-2026-33382 is a security advisory published by Grafana Labs Security. Grafana denial of service via oversized request bodies (web.Bind)

Why does CVE-2026-33382 have no CVE ID yet?

Grafana Labs Security published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by CVE-2026-33382?

CVE-2026-33382 affects 1 product, including: Grafana.

CVE-2026-33382Disclosed before NVD

Grafana denial of service via oversized request bodies (web.Bind)

Vendor

Grafana Labs Security

Published

June 9, 2026

Last Modified

—

📋 Description

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service. Upgrade to a fixed version listed below.

🎯 Affected products1

Grafana

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-33382/