Red Hat Security Advisory: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * go-git: argument injection via the URL field (CVE-2025-21613) * go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies (CVE-2025-21614) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
This advisory covers two security vulnerabilities in the go-git library used by Grafana. CVE-2025-21613 is an argument injection vulnerability via the URL field, which could allow an attacker to inject malicious arguments. CVE-2025-21614 is a denial of service vulnerability where go-git clients can be disrupted by maliciously crafted Git server replies. Red Hat has released updated Grafana packages for Red Hat Enterprise Linux 9.4 Extended Update Support to address these issues. The advisory references bugzilla entries BZ-2335888 and BZ-2335901 for the respective CVEs. No CVSS scores are provided in the advisory.
Potential Impact
The vulnerabilities could allow attackers to inject arguments via the URL field, potentially leading to unintended behavior or exploitation, and to cause denial of service conditions by sending malicious Git server replies to go-git clients. The impact is rated as Important by Red Hat, indicating a significant security risk that could affect the availability and integrity of Grafana services using the affected go-git versions.
Mitigation Recommendations
Red Hat has released updated Grafana packages for Red Hat Enterprise Linux 9.4 Extended Update Support that fix these vulnerabilities. Users should apply the provided security updates as detailed in the Red Hat advisory RHSA-2025:0662 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.
Red Hat Security Advisory: grafana security update
Description
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * go-git: argument injection via the URL field (CVE-2025-21613) * go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies (CVE-2025-21614) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers two security vulnerabilities in the go-git library used by Grafana. CVE-2025-21613 is an argument injection vulnerability via the URL field, which could allow an attacker to inject malicious arguments. CVE-2025-21614 is a denial of service vulnerability where go-git clients can be disrupted by maliciously crafted Git server replies. Red Hat has released updated Grafana packages for Red Hat Enterprise Linux 9.4 Extended Update Support to address these issues. The advisory references bugzilla entries BZ-2335888 and BZ-2335901 for the respective CVEs. No CVSS scores are provided in the advisory.
Potential Impact
The vulnerabilities could allow attackers to inject arguments via the URL field, potentially leading to unintended behavior or exploitation, and to cause denial of service conditions by sending malicious Git server replies to go-git clients. The impact is rated as Important by Red Hat, indicating a significant security risk that could affect the availability and integrity of Grafana services using the affected go-git versions.
Mitigation Recommendations
Red Hat has released updated Grafana packages for Red Hat Enterprise Linux 9.4 Extended Update Support that fix these vulnerabilities. Users should apply the provided security updates as detailed in the Red Hat advisory RHSA-2025:0662 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:0662
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-21614"]
Threat ID: 6a1f4e9ee29bf47b50086ea1
Added to database: 06/02/2026, 21:43:58 UTC
Last enriched: 08/11/2026, 20:44:36 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 43
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.