Tempo Vulnerability: High-Severity Flaw Risks Service Availability

The National Vulnerability Database has detailed CVE-2026-21728, a critical vulnerability in Tempo that could cripple service availability. Attackers can exploit this flaw by sending large limit queries, forcing the service into substantial memory allocations. This denial-of-service vector is particularly concerning as it requires no authentication (PR:N) and has a low attack complexity (AC:L), making it accessible to a wide range of threat actors.

The National Vulnerability Database highlights a CVSS score of 7.5 (HIGH), underscoring the severity. While specific affected products are not detailed, any deployment relying on Tempo for data processing or querying is at risk. The core issue lies in unchecked resource consumption, a classic DoS pattern that can cascade into wider system instability depending on how Tempo is integrated and scaled within an organization’s infrastructure.

Defenders must act proactively. The National Vulnerability Database recommends mitigating this by configuring the max_result_limit in the search configuration. Setting this to a reasonable value, such as 262144 (2^18), can prevent excessive memory usage. This is a prime example where a simple configuration tweak can significantly harden a service against a known attack vector.