CVE-2026-21728

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.

Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

Vendor	Product	Versions
Grafana	Tempo	>= 1.3.0, <= 2.8.3; >= 2.9.0, <= 2.9.1; >= 2.10.0, <= 2.10.1
Grafana	Enterprise Traces (GET)	>= 1.0.0, <= 2.8.7
Red Hat	Multicluster Global Hub 1.3.4	—
Red Hat	Multicluster Global Hub 1.4.5	—
Red Hat	Multicluster Global Hub 1.6.5	—
Red Hat	Multicluster Global Hub 1.7.0	—
Red Hat	Red Hat multicluster global hub 1.5.3	—
Red Hat	Logging Subsystem for Red Hat OpenShift	—
Red Hat	Multicluster Global Hub	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	—
Red Hat	Red Hat Ceph Storage 5	—
Red Hat	Red Hat Ceph Storage 6	—
Red Hat	Red Hat Ceph Storage 9	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat OpenShift distributed tracing 3	—
Red Hat	Red Hat OpenShift distributed tracing 3	—
Red Hat	Red Hat OpenShift distributed tracing 3	—
Red Hat	Red Hat OpenShift distributed tracing 3	—

References

Timeline

Published: Apr 24, 2026
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-217297.5Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deploym CVE-2026-21739.8A vulnerability was identified in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the f CVE-2026-217306.1Verba is affected by a Stored Cross-Site Scripting (XSS) vulnerability within its login logging mechanism. When an unauthenticated remote at CVE-2026-217329.6A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash i CVE-2026-217337.3Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user CVE-2026-217347.7A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash i CVE-2026-217364.4Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user CVE-2026-21749.8A security flaw has been discovered in code-projects Contact Management System 1.0. This affects an unknown part of the component CRUD Endpo CVE-2026-217414.8An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, For CVE-2026-217426.5A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through CVE-2026-217437.2A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenti CVE-2026-21757.2A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420618 of the file /goform/set_upnp. T