alpine-cve-2026-88858

CVSS 6.5 osv_alpine
Description

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "affected": [
    {
      "database_specific": {
        "source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-88858.json"
      },
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.24",
        "name": "grafana",
        "purl": "pkg:apk/alpine/grafana?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.4.14-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.",
  "id": "ALPINE-CVE-2026-88858",
  "modified": "2026-11-04T22:30:02.919350421Z",
  "published": "2026-10-28T17:18:45.967Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security.alpinelinux.org/vuln/CVE-2026-88858"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-88858"
  ]
}
View JSON API Download JSON