Grafana Git Sync Uncontrolled Resource Consumption (Memory Exhaustion)
CVE-2026-95502 Published on October 13, 2026
Git Sync memory exhaustion via a malicious Git server
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.
Weakness Types
Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
What is a Data Amplification Vulnerability?
The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.
CVE-2026-95502 has been classified to as a Data Amplification vulnerability or weakness.
Products Associated with CVE-2026-95502
Want to know whenever a new CVE is published for Grafana Labs Grafana? stack.watch will email you.
Affected Versions
Grafana Nanogit:- Before 1.7.0 is affected.
- Version 13.0.0 and below 13.0.11 is affected.
- Version 13.1.0 and below 13.1.8 is affected.
- Version 13.2.0 and below 13.2.4 is affected.
- Version 13.0.0 and below 13.0.11 is affected.
- Version 13.1.0 and below 13.1.8 is affected.
- Version 13.2.0 and below 13.2.4 is affected.