CVE-2026-21729: Loki DoS Vulnerability via Memory Exhaustion

CVE-2026-21729 Overview

CVE-2026-21729 affects Grafana Loki, a log aggregation system. Unauthenticated attackers can submit queries with large limit parameters, forcing the service to allocate excessive memory. The resulting resource exhaustion can degrade or crash Loki instances depending on the deployment architecture.

The vulnerability is classified under [CWE-770: Allocation of Resources Without Limits or Throttling]. It requires no authentication or user interaction and is reachable over the network. Availability impact is high, while confidentiality and integrity remain unaffected.

Critical Impact
Remote attackers can trigger memory exhaustion in Loki through crafted queries with large limits, causing service disruption for log ingestion and query pipelines.

Affected Products

Grafana Loki (log aggregation system)
Deployments exposing the Loki query API to untrusted clients
Monolithic and microservices Loki deployment topologies

Discovery Timeline

2026-07-16 - CVE-2026-21729 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-21729

Vulnerability Analysis

The vulnerability resides in Loki's query execution path. When a client submits a query, Loki honors the limit parameter that governs how many log entries to return. The service does not sufficiently constrain the upper bound of this value before allocating memory to hold intermediate and final result sets.

An attacker can submit queries specifying very large limits. Loki then attempts to reserve buffers proportional to that request. Under sustained or concurrent abuse, the process consumes available memory until it is killed by the operating system or Kubernetes out-of-memory (OOM) handler.

The impact scales with the deployment model. Monolithic Loki deployments face full service outage. Microservices deployments may see the querier or query-frontend components fail while other components continue operating.

Root Cause

The root cause is missing enforcement of a safe upper bound on the limit field in query requests. Under [CWE-770], resource allocation proceeds without validating that the requested size is within operationally sustainable limits for the host.

Attack Vector

The attack vector is network-based and requires no authentication when Loki endpoints are exposed without an authenticating proxy. An adversary sends HTTP query requests to the Loki API with a limit value large enough to force excessive allocation. Repeated requests amplify the impact and can exhaust cluster capacity.

Refer to the Grafana Security Advisory CVE-2026-21729 for vendor-supplied technical details and fixed versions.

Detection Methods for CVE-2026-21729

Indicators of Compromise

Loki querier or query-frontend pods restarting with OOMKilled status in Kubernetes.
Sudden spikes in Loki process resident memory correlated with inbound query traffic.
HTTP query requests to /loki/api/v1/query_range or /loki/api/v1/query containing unusually large limit values.
Increased latency or context deadline exceeded errors returned from Loki queriers.

Detection Strategies

Parse Loki access logs and alert on requests where the limit parameter exceeds an operationally normal threshold.
Monitor container runtime events for repeated OOMKilled terminations of Loki components.
Correlate memory pressure metrics with query request rates to identify abuse patterns.

Monitoring Recommendations

Export Loki metrics such as loki_request_duration_seconds and go_memstats_alloc_bytes to a metrics backend and set alert thresholds.
Track query patterns by source IP and tenant ID to identify anomalous callers.
Enable audit logging on any reverse proxy fronting Loki to preserve request forensics.

How to Mitigate CVE-2026-21729

Immediate Actions Required

Upgrade Loki to the fixed version identified in the Grafana Security Advisory CVE-2026-21729.
Enforce authentication and network access controls on all Loki API endpoints.
Configure per-tenant query limits in Loki's limits_config to cap max_entries_limit_per_query at a safe value.
Apply memory and CPU resource limits to Loki pods to contain the blast radius of abusive queries.

Patch Information

Grafana Labs has released fixed versions of Loki addressing CVE-2026-21729. Consult the Grafana Security Advisory CVE-2026-21729 for the specific patched versions and upgrade guidance.

Workarounds

Place Loki behind an authenticating reverse proxy that rejects requests exceeding a safe limit value.
Set max_entries_limit_per_query in the Loki configuration to bound query result sizes per tenant.
Rate-limit inbound query traffic at the ingress or gateway layer to reduce amplification.
Isolate the querier and query-frontend components from ingesters using separate resource pools to preserve write availability.

bash

# Configuration example: bound query limits in Loki limits_config
limits_config:
  max_entries_limit_per_query: 5000
  max_query_series: 500
  max_query_parallelism: 32
  max_query_length: 720h