CVE-2026-21720 Details
Description
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.
A denial-of-service vulnerability has been identified in Grafana. When an uncached avatar request is made, it triggers a goroutine to refresh the Gravatar image. If this refresh takes longer than three seconds in the 10-slot worker queue, the handler times out and stops waiting for the result. Consequently, the goroutine becomes blocked indefinitely, trying to send data on an unbuffered channel. This issue can be exploited by sending sustained traffic with random hashes, causing the goroutine count to increase linearly. Eventually, this growth exhausts system memory, leading Grafana to crash on certain systems.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-21720 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2433226 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21720.json | redhat-SADP | |
| https://grafana.com/security/security-advisories/cve-2026-21720 | [email protected] | Broken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
| CWE-703 | Improper Check or Handling of Exceptional Conditions | CISA-ADP |
| CWE-772 | Missing Release of Resource after Effective Lifetime | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| grafana grafana | >= 3.0.0, < 11.6.9 >= 12.0.0, < 12.0.8 >= 12.1.0, < 12.1.5 >= 12.2.0, < 12.2.3 12.3.0 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 17, 2026 | Initial Analysis | [email protected] |
| Jan 27, 2026 | CVE Modified | CISA-ADP |
| Jan 27, 2026 | New CVE Received | [email protected] |