---
id: CVE-2026-27878
aliases:
  - GHSA-6xff-cpcq-vpw2
  - GO-2026-6325
title: Grafana Tempo vulnerable to an out-of-memory crash
summary: Grafana Tempo vulnerable to an out-of-memory crash
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
vendor: grafana
product: github.com/grafana/tempo
ecosystem: go
affected:
  - github.com/grafana/tempo < 1.5.1-0.20260303204923-b13f74291d48
patched:
  - github.com/grafana/tempo 1.5.1-0.20260303204923-b13f74291d48
published: '2026-06-19'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:48.631810314Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6xff-cpcq-vpw2'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-27878'
  - url: 'https://github.com/grafana/tempo/pull/6559'
  - url: 'https://github.com/grafana/tempo/pull/6646'
  - url: 'https://github.com/grafana/tempo/pull/6792'
  - url: 'https://github.com/grafana/tempo/pull/6802'
  - url: >-
      https://github.com/grafana/tempo/commit/3d7c78d438890991df594c20ae2031f8934aba3b
  - url: >-
      https://github.com/grafana/tempo/commit/b13f74291d489672601a10297f8fbcbf7dd19192
  - url: >-
      https://github.com/grafana/tempo/commit/b481ae9693f99785691197915066e6306950fa09
  - url: >-
      https://github.com/grafana/tempo/commit/e2d51b786aff94de3319c07994c6a5539b121eb5
  - url: 'https://github.com/grafana/tempo'
  - url: 'https://github.com/grafana/tempo/releases/tag/v2.10.2'
  - url: 'https://github.com/grafana/tempo/releases/tag/v2.8.4'
  - url: 'https://github.com/grafana/tempo/releases/tag/v2.9.2'
  - url: 'https://grafana.com/security/security-advisories/cve-2026-27878'
tags:
  - osv
  - go
epss: 0.00411
epssPercentile: 0.3264
ingestedAt: '2026-08-29T19:29:15.038Z'
---

## Overview

A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.

## Affected packages

- `github.com/grafana/tempo < 1.5.1-0.20260303204923-b13f74291d48`

## Remediation

Upgrade to a patched release:

- `github.com/grafana/tempo 1.5.1-0.20260303204923-b13f74291d48`