---
id: CVE-2026-21720
title: >-
  Every uncached /avatar/:hash request spawns a goroutine that refreshes the
  Gravatar image
summary: >-
  Every uncached /avatar/:hash request spawns a goroutine that refreshes the
  Gravatar image. If the refresh sits in the 10-slot worker queue longer than
  three seconds, the handler times out and stops listening for the result, so
  that gorou…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
  - CWE-703
  - CWE-772
vendor: grafana
product: grafana
affected:
  - 'grafana >= 3.0.0, < 11.6.9'
  - 'grafana >= 12.0.0, < 12.0.8'
  - 'grafana >= 12.1.0, < 12.1.5'
  - 'grafana >= 12.2.0, < 12.2.3'
  - grafana = 12.3.0
patched:
  - grafana 12.2.3
published: '2026-01-27'
updated: '2026-06-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-21720'
references:
  - url: 'https://grafana.com/security/security-advisories/cve-2026-21720'
    label: security@grafana.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-21720'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2433226'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21720.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.00701
epssPercentile: 0.51138
ingestedAt: '2026-06-30T17:40:12.464Z'
---

## Overview

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.

## Affected

- `grafana >= 3.0.0, < 11.6.9`
- `grafana >= 12.0.0, < 12.0.8`
- `grafana >= 12.1.0, < 12.1.5`
- `grafana >= 12.2.0, < 12.2.3`
- `grafana = 12.3.0`

## Remediation

Upgrade past the affected range:

- `grafana 12.2.3`