CVE-2025-1088 Very long unicode dashboard title or panel name can hang the frontend
Attackers can cause browser unresponsiveness by submitting excessively long dashboard titles or panel names in Grafana.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-1088?
CVE-2025-1088 is a low-severity denial of service vulnerability in Grafana, published on 18 Jun 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.
Weakness: CWE-20
Which versions are affected by CVE-2025-1088?
6 open source packages ship an affected version, including github.com/grafana/grafana and grafana.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | All versions | 0.0.0-20250521211231-e0ba4b480954 |
github.com/grafana/grafana Go | All versions | 0.0.0-20250521211231-e0ba4b480954 |
github.com/grafana/grafana Go | All versions | 0.0.0-20250521211231-e0ba4b480954 |
github.com/grafana/grafana Go | From 0.0.1-test | 11.6.2 |
github.com/grafana/grafana Go | From 0.0.1-test | 11.6.2 |
grafana Bitnami | All versions | 11.6.2 |
How do I fix CVE-2025-1088?
Upgrade github.com/grafana/grafana to a fixed version for your release line: 0.0.0-20250521211231-e0ba4b480954 or 11.6.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-1088 being exploited?
There is no known exploitation of CVE-2025-1088 in the wild and no public exploit code.
Sources
Also known as BIT-grafana-2025-1088, GHSA-crvv-6w6h-cv34, GO-2025-3766, MINI-3888-x5gc-wx5r, MINI-55j2-4gmg-xxw8, MINI-5qv2-63rx-rvvr and 16 more.