A memory exhaustion vulnerability in Grafana and Grafana Enterprise allows unauthenticated remote attackers to trigger a service crash through sustained traffic.

The application incorrectly handles goroutines during Gravatar image refreshes, where requests that time out continue to block indefinitely, eventually leading to uncontrolled resource consumption by an unauthenticated attacker.

Successful exploitation of this vulnerability results in a denial of service, rendering Grafana instances unavailable to legitimate users. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to operational continuity, potentially causing system crashes that require manual intervention to restore service.

Immediate Action: Upgrade Grafana and Grafana Enterprise to version 11.6.9, 12.0.8, 12.1.5, or later, as provided in the official vendor security advisory.

Proactive Monitoring: Monitor server memory utilization and identify spikes in requests to the /avatar/ endpoint, which may indicate an ongoing exploitation attempt.

Compensating Controls: Deploy a Web Application Firewall (WAF) to rate-limit requests to the /avatar/ path, effectively mitigating the ability of an attacker to send the sustained traffic required to trigger the memory exhaustion.

Public Exploit Available: No confirmed public exploit exists in the provided data.

This vulnerability presents a clear risk to availability and should be prioritized for remediation. Administrators must verify their current Grafana version and apply the appropriate security updates immediately to prevent potential service instability caused by memory exhaustion.