CVE-2025-1088 - Vulnerability Details - OpenCVE

In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://grafana.com/security/security-advisories/cve-2025-1088/
https://nvd.nist.gov/vuln/detail/CVE-2025-1088
https://www.cve.org/CVERecord?id=CVE-2025-1088

History

Fri, 20 Jun 2025 02:45:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2025-1088 https://www.cve.org/CVERecord?id=CVE-2025-1088
Metrics	threat_severity `None`	threat_severity `Low`

Wed, 18 Jun 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 18 Jun 2025 10:00:00 +0000

Type	Values Removed	Values Added
Description		In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.
Title		Very long unicode dashboard title or panel name can hang the frontend
Weaknesses		CWE-20
References		https://grafana.com/security/security-advisories/cve-2025-1088/
Metrics		cvssV3_1 `{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L'}`

MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published: 2025-06-18T09:54:30.329Z

Updated: 2025-06-18T13:32:38.403Z

Reserved: 2025-02-06T16:20:20.820Z

Link: CVE-2025-1088

Vulnrichment

Updated: 2025-06-18T13:32:31.413Z

NVD

Status : Awaiting Analysis

Published: 2025-06-18T10:15:31.210

Modified: 2025-06-18T13:46:52.973

Link: CVE-2025-1088

Redhat

Severity : Low

Publid Date: 2025-06-18T09:54:30Z

Links: CVE-2025-1088 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-1088", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2025-02-06T16:20:20.820Z", "datePublished": "2025-06-18T09:54:30.329Z", "dateUpdated": "2025-06-18T13:32:38.403Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2025-06-18T09:54:30.329Z"}, "title": "Very long unicode dashboard title or panel name can hang the frontend", "datePublic": "2025-06-18T09:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "type": "CWE"}]}], "affected": [{"vendor": "Grafana", "product": "Grafana", "versions": [{"status": "affected", "version": "0", "lessThan": "11.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana.\nThis issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana.<br>This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher."}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2025-1088/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseSeverity": "LOW", "baseScore": 2.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"}}], "credits": [{"lang": "en", "value": "Jinay Patel", "type": "finder"}, {"lang": "en", "value": "Shrey Shah", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-18T13:27:31.207693Z", "id": "CVE-2025-1088", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-18T13:32:38.403Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1088", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-18T13:27:31.207693Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-18T13:32:31.413Z"}}], "cna": {"title": "Very long unicode dashboard title or panel name can hang the frontend", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Jinay Patel"}, {"lang": "en", "type": "finder", "value": "Shrey Shah"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Grafana", "product": "Grafana", "versions": [{"status": "affected", "version": "0", "lessThan": "11.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2025-06-18T09:00:00.000Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2025-1088/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana.\nThis issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.", "supportingMedia": [{"type": "text/html", "value": "In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana.<br>This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2025-06-18T09:54:30.329Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1088", "state": "PUBLISHED", "dateUpdated": "2025-06-18T13:32:38.403Z", "dateReserved": "2025-02-06T16:20:20.820Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2025-06-18T09:54:30.329Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.1"}