Home

Description

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.

PUBLISHED Reserved 2026-01-05 | Published 2026-01-27 | Updated 2026-02-07 | Assigner GRAFANA




HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Product status

Default status
unaffected

3.0.0 (semver) before 11.6.9
affected

Default status
unaffected

3.0.0 (semver) before 12.0.8
affected

Default status
unaffected

3.0.0 (semver) before 12.1.5
affected

Default status
unaffected

3.0.0 (semver) before 11.6.9
affected

Default status
unaffected

3.0.0 (semver) before 12.0.8
affected

Default status
unaffected

3.0.0 (semver) before 12.1.5
affected

Default status
unaffected

3.0.0 (semver) before 12.2.3
affected

Default status
unaffected

3.0.0 (semver) before 12.2.3
affected

Default status
unaffected

3.0.0 (semver) before 12.3.1
affected

Default status
unaffected

3.0.0 (semver) before 12.3.1
affected

References

grafana.com/security/security-advisories/CVE-2026-21720 vendor-advisory

cve.org (CVE-2026-21720)

nvd.nist.gov (CVE-2026-21720)

Download JSON