An unauthenticated remote attacker can cause a denial of service in Grafana Tempo and Grafana Enterprise Traces by submitting queries with large limits, which triggers excessive memory allocation.

The vulnerability is an improper resource management flaw where the application fails to adequately constrain memory allocation for incoming search queries. This allows an unauthenticated attacker to exhaust system memory, potentially forcing a service restart or crashing the node.

The exploitation of this vulnerability directly impacts service availability, which can disrupt observability pipelines and monitoring operations. Given the CVSS score of 7.5, this is classified as a High severity issue because it allows for an unauthenticated attacker to degrade infrastructure performance or cause complete service outages, leading to potential operational downtime.

Immediate Action: Update Grafana Tempo to versions 2.8.4, 2.9.2, or 2.10.2 as appropriate for your deployment. If immediate patching is not feasible, apply the mitigation by setting the max_result_limit parameter in the search configuration to 262144.

Proactive Monitoring: Monitor system memory usage and service logs for spikes in memory consumption or unexpected service restarts that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or API gateway to filter incoming requests and limit query parameters that could trigger excessive resource consumption.

Public Exploit Available: Unknown.

The vulnerability poses a significant risk to the stability of Grafana Tempo environments. Organizations should prioritize updating to the fixed versions listed in this advisory. If an immediate update is not possible, implementing the recommended configuration change to limit search results is a critical step to prevent service disruption from malicious or accidental query load.