Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
⚠️ Vulnerabilidades en productos Grafana ❗ CVE-2026-21721 ❗ CVE-2026-21720 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-grafana/ https://t.co/1H4Qhzv7aQ
Post summary
The tweet merely announces the presence of CVE‑2026‑21721 and CVE‑2026‑21720 for Grafana without providing technical details, patches, or exploitation information.
CVE-2026-21720 In Grafana Enterprise, unauth /avatar/:hash requests spawn goroutines that leak on timeout due to unbuffered channel, resulting in memory exhaustion and DoS. Severity: High PoC: n/a Exploited: n/a Product: grafana:grafana-grafana-enterprise
Post summary
The post announces CVE‑2026‑21720 as a high‑severity DoS vulnerability in Grafana Enterprise caused by goroutine leaks on unauthenticated /avatar requests. No PoC, exploit, or patch is reported, and no evidence of active exploitation is provided.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | grafana | grafana | - | - | - |
| App | grafana | grafana | - | - | - |
| App | grafana | grafana | 12.3.0 | - | - |
| App | grafana | grafana | 12.3.0 | - | - |