CVE-2026-95502: Git Sync memory exhaustion via a malicious Git server
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only Grafana deployments where an administrator has configured Git Sync (provisioning) to use the malicious Git server are exposed. Grafana instances without Git Sync configured against that server are not described as affected.
What access does an attacker need to trigger the memory exhaustion?
The attacker needs control of, or the ability to make malicious responses from, the Git server configured for Grafana Git Sync. No authentication or user interaction is required once Grafana is configured to synchronize with that server.
What is the likely operational impact?
A malicious server can return oversized or highly compressed responses that exhaust Grafana memory. The stated impact is reduced availability; no confidentiality or integrity impact is indicated.