Approved changes feed: RSS · Atom
cpe:2.3:a:grafana:loki:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Grafana (7564912d-bb81-50cf-9eb9-f573ac2fa519) |
|---|---|
| Product | Loki (f4800d17-5bb5-5d58-8660-d5266423cdce) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/grafana/loki |
purl2cpe | 2026-06-01 10:14:45.891539 |
pkg:github/grafana/loki |
purl2cpe | 2026-06-01 10:14:45.891542 |
pkg:rpm/opensuse/loki |
purl2cpe | 2026-06-01 10:14:45.891545 |
pkg:sourceforge/grafana-loki.mirror |
purl2cpe | 2026-06-01 10:14:45.891548 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-21729 |
vulnerable | 2026-07-29 00:29:08.159038 |
Loki detected_fields query limits results in unbounded memory allocation
HIGH (7.5)
Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.
Published: 2026-07-16T03:12:07.912Z
Updated: 2026-07-29T13:59:46.962Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-21726 |
vulnerable | 2026-06-08 07:49:16.730661 |
Loki Path Traversal - CVE-2021-36156 Bypass
MEDIUM (5.3)
The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}
Thanks to Prasanth Sundararajan for reporting this vulnerability.
Published: 2026-04-15T19:24:31.268Z
Updated: 2026-07-29T14:00:06.942Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36156 |
vulnerable | 2026-06-08 05:32:49.796642 |
Details available
An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message.
Published: 2021-08-03T14:12:11.000Z
Updated: 2024-08-04T00:47:43.938Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.