Review reviewHigh

CVE-2026-21720

Grafana grafana/grafana-enterprise, grafana/grafana, Red Hat Ceph Storage 7

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.

CVSS: 7.5
EPSS: 0.62%
CISA KEV: Not listed
Published: 2026.01.27

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.62%

Technical severityCVSS 7.5

Vulnerability overview

Affected product and versions

Product: Grafana grafana/grafana-enterprise, grafana/grafana, Red Hat Ceph Storage 7
Affected versions: >= 3.0.0 < 11.6.9, >= 3.0.0 < 12.0.8, >= 3.0.0 < 12.1.5, >= 3.0.0 < 12.2.3, >= 3.0.0 < 12.3.1, >= 12.0.0 < 12.0.8, >= 12.1.0 < 12.1.5, >= 12.2.0 < 12.2.3, 12.3.0
Fixed versions: 11.6.9, 12.0.8, 12.1.5, 12.2.3

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Grafana grafana/grafana-enterprise, grafana/grafana, Red Hat Ceph Storage 7 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-400, CWE-703, CWE-772