Tempo query limit results in unbounded memory allocation
High
- Advisory ID:
- CVE-2026-21728
- Published:
- 2026-04-24
- Product:
- Tempo
- CVSS Score:
- 7.5
- CVSS Vector:
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Fixed Versions:
- >=2.8.4>=2.9.2>=2.10.2
Summary
If an attacker can submit Tempo queries with large limits, they can trigger unbounded memory allocations, which can impact the availability of the service.
As a mitigation, set max_result_limit in the search configuration (for example, 262144 / 2^18). Alternatively, automatically restart the service.
Upgrade to a fixed version listed below.