grafana/tempo
GitHub
CVE History
| CVE | Affected | Published | CVSS v3 | CVSS v2 |
|---|---|---|---|---|
| >= 2.6.0, < 2.8.4, >= 2.9.0, < 2.9.2, >= 2.10.0, < 2.10.2 | 6.5 MEDIUM | — | ||
A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service. | ||||
| >= 1.3.0, < 2.8.4, >= 2.9.0, < 2.9.2, >= 2.10.0, < 2.10.2 | 7.5 HIGH | — | ||
Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). | ||||
| < 2.10.3 | 7.5 HIGH | — | ||
A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to william_goodfellow for reporting this vulnerability. | ||||