Grafana Denial-of-Service Vulnerability via Uncached Avatar Requests

A denial-of-service vulnerability has been identified in Grafana. When an uncached avatar request is made, it triggers a goroutine to refresh the Gravatar image. If this refresh takes longer than three seconds in the 10-slot worker queue, the handler times out and stops waiting for the result. Consequently, the goroutine becomes blocked indefinitely, trying to send data on an unbuffered channel. This issue can be exploited by sending sustained traffic with random hashes, causing the goroutine count to increase linearly. Eventually, this growth exhausts system memory, leading Grafana to crash on certain systems.

Impact

Exploitation of this vulnerability causes Grafana to crash, exhausting system memory and disrupting service.