CVE-2026-21720 Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out
Unauthenticated attackers can cause Grafana to crash by exhausting memory through goroutine leaks triggered by timed-out avatar requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-21720?
CVE-2026-21720 is a high-severity denial of service vulnerability in Grafana Grafana, published on 27 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.
Which versions are affected by CVE-2026-21720?
1 open source package ship an affected version, including grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 3.0.0 | 11.6.9, 12.0.8, 12.1.5, 12.2.3, 12.3.1 |
Products include Grafana Grafana.
How do I fix CVE-2026-21720?
Upgrade grafana to a fixed version for your release line: 11.6.9, 12.0.8, 12.1.5 or 12.2.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-21720 being exploited?
There is no known exploitation of CVE-2026-21720 in the wild and no public exploit code.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2026-21720, CLSA-2026-1775824794, CLSA-2026-1775825437, GHSA-m4rj-q4ph-fr4v, MINI-2chx-2fp4-x7hx, MINI-3fwr-w8hj-3c9m and 13 more.