CVE-2026-21728 — Tempo query limit results in unbounded memory allocation

Affected: Grafana Tempo, Grafana Enterprise Traces (GET), Red Hat Multicluster Global Hub 1.3.4, Red Hat Multicluster Global Hub 1.4.5, Red Hat Multicluster Global Hub 1.6.5, Red Hat Multicluster Global Hub 1.7.0, Red Hat multicluster global hub 1.5.3, Red Hat Logging Subsystem for Red Hat OpenShift, Red Hat Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2 and 6 more

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.

Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.

GHSA-jpcw-4wr7-c3vq — kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter w…

Affected: Go: github.com/getkin/kin-openapi

| Field | Value | |---|---| | Ecosystem | Go | | Package | `github.com/getkin/kin-openapi` | | Affected versions | `<= 0.143.0` (introduced in `v0.2.0`, PR #90, 2019-05-07; reproduced on `HEAD` `30e2923`) | | Patched versions | 0.144.0 | ---

### Summary

`openapi3filter.ValidateRequest` contains a NULL-pointer-dereference denial of service: any **unauthenticated** client can crash the request-validation path with a **single** HTTP request. When an operation declares a `content` parameter (as opposed to a `schema` parameter) whose media type object has **no `schema`**, request validation dereferences that missing schema and panics. The document is legal under the OpenAPI Specification — kin-openapi's own `doc.Validate()` accepts it — and the defect affects **both OpenAPI 3.0.x and 3.1.x**. Depending on how the library is wired into the server (see Impact), this ranges from a per-request abort with unbounded panic-log growth to a full remote process crash.

### Details

The decoder used for `content` parameters when no custom `ParamDecoder` is configured (the library default), `defaultContentParameterDecoder`, dereferences the media-type schema without a nil check.

`openapi3filter/req_resp_decoder.go`, around line 197:

```go mt := content.Get("application/json") if mt == nil { // media-type OBJECT is guarded ... err = fmt.Errorf("parameter %q has no content schema", param.Name) return } outSchema = mt.Schema.Value // ... but mt.Schema…

Most recent entries from all

CVE-2026-21728 — Tempo query limit results in unbounded memory allocation

GHSA-jpcw-4wr7-c3vq — kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter w…