CVE-2026-95502
Fixed in a distro release EPSS <1%CVSS 5.3
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.
Products: Grafana Nanogit, Grafana OSS, Grafana Enterprise
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat hummingbird 1 | grafana12.4 | 0:12.4.12-0.4.hum1 |
| Red Hat hummingbird 1 | grafana13.2 | 0:13.2.4-0.1.hum1 |