CVE-2026-95502
Received Received - Intake

Grafana Memory Exhaustion via Git Sync Git Server

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Grafana Labs

Description
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-95502
EUVD
EUVD-2026-98902

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
Grafana Nanogit 0
Grafana Grafana OSS 13.0.0
Grafana Grafana OSS 13.1.0
Grafana Grafana OSS 13.2.0
Grafana Grafana Enterprise 13.0.0
Grafana Grafana Enterprise 13.1.0
Grafana Grafana Enterprise 13.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a Git server configured for Grafana's Git Sync feature sending oversized or highly compressed responses. This causes Grafana to consume excessive memory, leading to uncontrolled resource consumption.

Impact Analysis

An attacker could exploit this by having the Git server return maliciously large responses, causing Grafana to run out of memory. This may lead to service disruption or crashes for Grafana instances using Git Sync with the vulnerable server.

Mitigation Strategies

Review Git Sync configurations in Grafana to ensure the configured Git server is trusted and not returning oversized or highly compressed responses. Monitor memory usage on Grafana instances for signs of uncontrolled resource consumption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95502. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart