An unauthenticated remote denial of service vulnerability in Grafana allows attackers to crash instances by sending specifically crafted requests to the feature toggle evaluation endpoint.

This is a resource exhaustion vulnerability occurring within the OpenFeature feature toggle evaluation endpoint. The application fails to properly constrain the size of input values before reading them into memory, allowing unauthenticated attackers to trigger an out-of-memory condition.

Successful exploitation of this vulnerability results in the immediate crash of the affected Grafana service, causing significant operational downtime. With a CVSS score of 7.5, this high-severity flaw poses a risk to business continuity, as it allows external actors to disrupt critical observability and monitoring dashboards without requiring any prior authentication.

Immediate Action: Update all affected Grafana instances to the patched versions (v12.1.10, v12.2.8, v12.3.6, or v12.4.2) as specified in the vendor security advisory.

Proactive Monitoring: Monitor system logs and infrastructure metrics for frequent service restarts or memory spikes associated with requests to the OpenFeature endpoint.

Compensating Controls: Deploy a Web Application Firewall to inspect incoming requests and block abnormally large payloads directed at the feature toggle evaluation endpoint.

Public Exploit Available: Unknown

Given the high impact on service availability and the ease of exploitation, organizations should prioritize patching their Grafana deployments immediately. Administrators must verify their current version against the affected ranges and apply the provided security updates to prevent potential denial of service attacks against their monitoring infrastructure.