Skip to content
OpenAdvisories
High RLSA-2025:0401 2 CVEs

Important: grafana security update

Published Feb 13, 2025 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* go-git: argument injection via the URL field (CVE-2025-21613)

* go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies (CVE-2025-21614)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 grafana 0:9.2.10-21.el8_10

Vulnerabilities 2

  • Critical 9.2
    CVE-2025-21613

    go-git has an Argument Injection via the URL field

    go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to…

    go-git go-git zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • High 7.5
    CVE-2025-21614

    go-git clients vulnerable to DoS via maliciously crafted Git server replies

    go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing spec…

    go-git go-git zot kubescape Debian Ubuntu Azure Linux Wolfi Go

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2335888
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2335901