CVE-2026-33374: Grafana Prometheus API DOS Vulnerability

CVE-2026-33374 Overview

CVE-2026-33374 affects Grafana's Prometheus rule conversion API endpoints. The endpoints do not enforce a limit on incoming request body size. Authenticated users can submit arbitrarily large payloads that trigger unbounded memory allocation on the server. The resulting out-of-memory condition crashes the Grafana process and interrupts monitoring and alerting workflows.

The flaw maps to CWE-400: Uncontrolled Resource Consumption. Exploitation requires network reach to the API and valid low-privilege credentials. Successful attacks produce a denial-of-service condition against observability infrastructure that many downstream teams depend on.

Critical Impact
An authenticated attacker can crash the Grafana server by sending oversized requests to the Prometheus rule conversion API, disrupting monitoring and alerting for all tenants served by the instance.

Affected Products

Grafana instances exposing the Prometheus rule conversion API endpoints
Grafana deployments permitting authenticated API access to standard users
Self-hosted and managed Grafana configurations relying on Prometheus rule migration tooling

Discovery Timeline

2026-10-13 - CVE-2026-33374 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-33374

Vulnerability Analysis

Grafana exposes API endpoints that convert Prometheus rule definitions into Grafana-native rule objects. These endpoints read the HTTP request body into memory before parsing. The handlers do not apply a maximum body size, and they do not stream the payload with bounded buffers.

An authenticated client can therefore submit a very large request body. The server attempts to allocate memory proportional to the submitted payload. When the allocation exceeds available heap, the Go runtime terminates the process, taking down dashboards, alerting pipelines, and data source proxies.

The issue is a classic resource exhaustion flaw tracked as [CWE-400]. The attack targets availability only; the vulnerability does not expose or modify data. However, because Grafana often sits at the center of operational visibility, a crash can obscure concurrent incidents on monitored systems.

Root Cause

The root cause is missing input size validation in the Prometheus rule conversion handlers. The HTTP layer accepts request bodies without applying a MaxBytesReader or equivalent limit. Memory allocation during unmarshalling scales directly with attacker-controlled input length.

Attack Vector

The attack vector is network-based and requires authentication. Any user account with permission to call the rule conversion endpoints can submit the malicious request. User interaction is not required, and the request itself is a well-formed API call containing an oversized body. Repeated requests from a single authenticated session are sufficient to force an out-of-memory crash.

The vulnerability is described in prose only; no verified public exploit code is referenced in the advisory. See the Grafana Security Advisory CVE-2026-33374 for vendor-provided technical details.

Detection Methods for CVE-2026-33374

Indicators of Compromise

HTTP POST or PUT requests to Prometheus rule conversion API paths with Content-Length values far exceeding typical rule payloads
Grafana server processes terminating with out-of-memory signals or sudden restarts logged by the init system
Spikes in resident memory on Grafana hosts correlated with authenticated API traffic from a single account

Detection Strategies

Alert on HTTP requests to Grafana API endpoints where request body size exceeds a baseline threshold for rule conversion operations
Correlate Grafana process restarts and OOM-killer events with preceding authenticated API activity in access logs
Review audit logs for repeated calls to rule conversion endpoints originating from a single user or API token within short time windows

Monitoring Recommendations

Export Grafana access logs and host memory metrics into a centralized analytics platform for cross-source correlation
Track per-user API request rates and payload sizes against the rule conversion endpoints
Monitor kernel logs for oom-killer events targeting the Grafana binary and link them to upstream request telemetry

How to Mitigate CVE-2026-33374

Immediate Actions Required

Upgrade Grafana to the fixed release identified in the Grafana Security Advisory CVE-2026-33374
Restrict access to the Prometheus rule conversion API to trusted administrative roles until patching is complete
Rotate API tokens that may have been used by untrusted or shared accounts

Patch Information

Grafana has published a security advisory for CVE-2026-33374 with upgrade guidance. Administrators should consult the vendor advisory for the specific fixed versions applicable to their deployment channel and apply the update across all Grafana instances, including replicas behind load balancers.

Workarounds

Place Grafana behind a reverse proxy and enforce a maximum request body size for API routes handling rule conversion
Apply web application firewall rules that reject oversized payloads targeting the Prometheus rule conversion endpoints
Reduce the privilege of non-administrative users so they cannot invoke the vulnerable endpoints until the patch is deployed

bash

# Example NGINX reverse proxy limit for Grafana API traffic
http {
    client_max_body_size 1m;

    server {
        listen 443 ssl;
        server_name grafana.example.com;

        location /api/ {
            client_max_body_size 512k;
            proxy_pass http://grafana_upstream;
        }
    }
}