CVE-2025-10630 - CVE House

Back to Database

Status published Medium CVE-2025-10630

Regex DoS in Grafana Zabbix Plugin

4.3 CVSS

Vulnerability Description

Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix and create dashboards for analyzing metrics and realtime monitoring. Versions 5.2.1 and below contained a ReDoS vulnerability via user-supplied regex query which could causes CPU usage to max out. This vulnerability is fixed in version 6.0.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-10630

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

jub0bs

References

More from Grafana

View All →

SSRF in Infinity Datasource Plugin

An open redirect vulnerability has been identified in Grafana OSS...

An open redirect vulnerability has been identified in Grafana OSS...

A cross-site scripting (XSS) vulnerability exists in Grafana caused by...

Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection

Affected Vendor

Grafana

View all reports →

Affected Software

grafana-zabbix-plugin

Vulnerable Versions:

0

Timeline

Official Publish: September 19th, 2025

Last Modified: September 24th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation