CVE-2026-95502

Awaiting Analysis Awaiting Analysis - Queue

Grafana Memory Exhaustion via Git Sync Git Server

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Grafana Labs

Description

A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-95502

EUVD

EUVD-2026-98902

Affected Vendors & Products

Vendor	Product	Version / Range
Grafana	Nanogit	0
Grafana	Grafana	OSS 13.0.0
Grafana	Grafana	OSS 13.1.0
Grafana	Grafana	OSS 13.2.0
Grafana	Grafana	Enterprise 13.0.0
Grafana	Grafana	Enterprise 13.1.0
Grafana	Grafana	Enterprise 13.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability involves a Git server configured for Grafana's Git Sync feature sending oversized or highly compressed responses. This causes Grafana to consume excessive memory, leading to uncontrolled resource consumption.

Detection Guidance

Monitor Grafana memory usage and logs for Git Sync operations. Check for unusually large or compressed responses from configured Git servers. Use Grafana's built-in metrics or tools like 'top' or 'htop' to observe memory consumption during Git Sync activities.

Impact Analysis

An attacker could exploit this by having the Git server return maliciously large responses, causing Grafana to run out of memory. This may lead to service disruption or crashes for Grafana instances using Git Sync with the vulnerable server.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by causing service disruptions or data processing delays if Grafana's availability is compromised due to memory exhaustion. However, the vulnerability itself does not directly lead to data breaches or unauthorized access.

Mitigation Strategies

Review Git Sync configurations in Grafana to ensure the configured Git server is trusted and not returning oversized or highly compressed responses. Monitor memory usage on Grafana instances for signs of uncontrolled resource consumption.

Hi! I’m here to help you understand CVE-2026-95502. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70