MEDIUMCVSS 6.5EPSS 0.4%

CVE-2026-27878

Grafana Tempo vulnerable to an out-of-memory crash

Published: 2026-06-19
Modified: 2026-08-28
EPSS percentile: 34%
Aliases: GHSA-6xff-cpcq-vpw2
Sources: github-advisory

Summary

A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Go	github.com/grafana/tempo	—	1.5.1-0.20260303204923-b13f74291d48

Remediation: Upgrade to 1.5.1-0.20260303204923-b13f74291d48 or later.

References

https://github.com/advisories/GHSA-6xff-cpcq-vpw2

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.