High severity · published Jan 27, 2026
CVE-2026-21720
Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Grafana · Grafana
3.0.0 before 11.6.9; 3.0.0 before 12.0.8; 3.0.0 before 12.1.5; 3.0.0 before 12.2.3; 3.0.0 before 12.3.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-21720
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-21720
Broken Link
https://grafana.com/security/security-advisories/cve-2026-21720
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-21720
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2433226
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21720.json
More from Grafana
7.5
CVE-2021-43798
Grafana path traversal
7.3
CVE-2021-39226
Snapshot authentication bypass in grafana
9.8
CVE-2025-41115
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user…
9.8
CVE-2023-3128
Grafana is validating Azure AD accounts based on the email claim
9.8
CVE-2022-28660
The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used
