What’s Vulnerable › Vulnerabilities

CVE-2026-21720: Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-27 · updated 2026-07-15
• Weakness: CWE-400

Description

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.

Affected products

• Grafana: from 3.0.0 before 11.6.9; from 12.0.0 before 12.0.8; from 12.1.0 before 12.1.5; from 12.2.0 before 12.2.3; 12.3.0 — fixed in 11.6.9, 12.0.8, 12.1.5, 12.2.3

How to fix

Upgrade to a fixed version: Grafana 11.6.9, 12.0.8, 12.1.5, 12.2.3. Check the vendor advisory for mitigations.

References

• https://grafana.com/security/security-advisories/cve-2026-21720
• https://access.redhat.com/security/cve/CVE-2026-21720
• https://bugzilla.redhat.com/show_bug.cgi?id=2433226
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21720.json

Get alerted when CVE-2026-21720 or the next vulnerability affects your stack