CVE-2026-95502
published 2026-10-13CVE-2026-95502: A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.37%
29.6th percentile
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| grafana | grafana_enterprise | >= 13.0.0 < 13.0.11 | 13.0.11 |
| grafana | grafana_enterprise | >= 13.1.0 < 13.1.8 | 13.1.8 |
| grafana | grafana_enterprise | >= 13.2.0 < 13.2.4 | 13.2.4 |
| grafana | grafana_oss | >= 13.0.0 < 13.0.11 | 13.0.11 |
| grafana | grafana_oss | >= 13.1.0 < 13.1.8 | 13.1.8 |
| grafana | grafana_oss | >= 13.2.0 < 13.2.4 | 13.2.4 |
| grafana | nanogit | < 1.7.0 | 1.7.0 |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| rhacm2 | acm-grafana-rhel9 | — | — |
| rhceph | grafana-rhel10 | — | — |
| rhceph | grafana-rhel9 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
grafana: grafana: Denial of Service via oversized Git Sync responses
vendor_redhat·2026-10-13·CVSS 5.3
CVE-2026-95502 [MEDIUM] CWE-770 grafana: grafana: Denial of Service via oversized Git Sync responses
grafana: grafana: Denial of Service via oversized Git Sync responses
A flaw was found in Grafana. A malicious or compromised Git server configured for Git Sync provisioning can return oversized or highly compressed responses, causing uncontrolled memory consumption. This issue can exhaust system memory, resulting in a Denial of Service (DoS) condition on the Grafana instance. Exploitation requires an administrator to have configured Git Sync to communicate with the untrusted server.
Package: multicluster-globalhub/multicluster-globalhub-grafana-rhel9 (Multicluster Global Hub) - Fix deferred
Package: rhacm2/acm-grafana-rhel9 (Red Hat Advanced Cluster Management for Kubernetes 2) - Fix deferred
Package: rhceph/grafana-rhel9 (Red Hat Ceph Storage 7) - Fix deferred
Package: rhceph/grafana
GHSA
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption).
ghsa_unreviewed·2026-10-13
CVE-2026-95502 [MEDIUM] CWE-409 A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption).
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.
No detection rules found.
No public exploits indexed.
2026-10-13
Published