Description
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Nanogit | < 1.7.0 | 1.7.0 |
| Grafana | Grafana OSS | 13.0.0 – < 13.0.11, 13.1.0 – < 13.1.8, 13.2.0 – < 13.2.4 | 13.0.11 |
| Grafana | Grafana Enterprise | 13.0.0 – < 13.0.11, 13.1.0 – < 13.1.8, 13.2.0 – < 13.2.4 | 13.0.11 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.12-0.4.hum1 | RHSA-2026:76677 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.4-0.1.hum1 | RHSA-2026:85544 |
Advisories 3
- RHSA-2026:76677 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:85544 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-3910 Grafana: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 19, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-95502 vendor-advisory