What is CVE-2026-107509?

CVE-2026-107509 is a security advisory published by Grafana Labs Security. Memory exhaustion denial of service in SQL Expressions

Why does CVE-2026-107509 name no CVE ID?

As we last read it, Grafana Labs Security's advisory lists no CVE ID. A vendor can publish an advisory before a CVE record exists for the flaw, and some advisories never get one. CVE IDs are assigned by CVE Numbering Authorities, not by NVD, and we have not measured when, or whether, a CVE record follows.

Which products are affected by CVE-2026-107509?

CVE-2026-107509 affects 1 product, including: Grafana.

CVE-2026-107509No CVE ID named

Memory exhaustion denial of service in SQL Expressions

Vendor

Grafana Labs Security

Published

November 10, 2026

Last Modified

—

📋 Description

A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that casts a value to a very large BINARY length (memory allocation with excessive size value). Thanks to lucifer_ for reporting this vulnerability to us via our vulnerability disclosure program.

🎯 Affected products1

Grafana

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-107509/