CVE-2026-95502

A flaw was found in Grafana. A malicious or compromised Git server configured for Git Sync provisioning can return oversized or highly compressed responses, causing uncontrolled memory consumption. This issue can exhaust system memory, resulting in a Denial of Service (DoS) condition on the Grafana instance. Exploitation requires an administrator to have configured Git Sync to communicate with the untrusted server.

This issue is rated Moderate. If an administrator configures Grafana Git Sync against a malicious or compromised Git server, oversized or highly compressed responses can exhaust Grafana memory and cause a denial of service. Confidentiality and integrity are not affected. Exploitation depends on administrator-configured Git Sync to an untrusted server, which limits practical exposure. Upstream affects Grafana 13.0.x before 13.0.11, 13.1.x before 13.1.8, and 13.2.x before 13.2.4; Red Hat streams shipping Grafana 12.x or earlier are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not point Git Sync at untrusted Git servers; use only trusted repositories and credentials. Restrict who can configure Git Sync and limit Grafana management-plane network exposure. Apply process or cgroup memory limits to contain memory-exhaustion impact.