CVE-2026-42127

A flaw was found in Grafana. An unauthenticated attacker can exploit the public dashboard query endpoint by sending arbitrarily large JSON payloads. This vulnerability, caused by a lack of request body size limits, triggers excessive memory allocation, leading to a denial of service through memor...

PT-2026-52860

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access tok...

Fastify denial-of-service vulnerability with large JSON payloads

Overview Affected versions of fastify are vulnerable to a denial of service when processing a request with Content-Type set to application/json and a very large payload. Recommendation Update to version 0.38.0 or later. References - Commit fabd2a0 - HackerOne Report 303632 - GitHub Advisory...