A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed… (CVE-2026-95502)

This vulnerability arises when Grafana's Git Sync provisioning feature interacts with a Git server that returns oversized or highly compressed responses. Such responses can exhaust Grafana's memory resources, causing a denial of service via uncontrolled resource consumption. Exploitation requires administrative configuration of Git Sync to use the malicious Git server. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and impact limited to availability loss. No patch or remediation details are currently available.

The impact is limited to availability degradation of Grafana due to memory exhaustion caused by oversized or highly compressed Git server responses. There is no impact on confidentiality or integrity. The vulnerability requires administrative configuration of Git Sync to a malicious or compromised Git server, which then can cause Grafana to consume excessive memory and potentially crash or become unresponsive.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid configuring Git Sync with untrusted or potentially malicious Git servers. Monitoring and limiting resource consumption related to Git Sync may help mitigate impact.