{"schemaVersion":3,"id":"CVE-2026-95502","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.","dates":{"published":"2026-10-13T17:05:49.670Z","modified":"2026-10-13T19:31:30.373Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00372,"percentile":0.29682,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-14T00:00:00.000Z","score":0.00372,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00372,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00372,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00372,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00372,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00372,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00372,"percentile":0.29682}],"last30":[{"date":"2026-10-14T00:00:00.000Z","score":0.00372,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00372,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00372,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00372,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00372,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00372,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00372,"percentile":0.29682}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-409","name":"Improper Handling of Highly Compressed Data (Data Amplification)","description":"The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/409.html"},{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling","description":"The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/770.html"}],"affected":[{"vendor":"grafana","product":"grafana enterprise","name":"Grafana Enterprise","label":"grafana enterprise","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 13.0.0, < 13.0.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.1.0, < 13.1.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.2.0, < 13.2.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 13.0.0, < 13.0.11 | ≥ 13.1.0, < 13.1.8 | ≥ 13.2.0, < 13.2.4","eol":null,"hubHref":"/vendor/grafana/grafana_enterprise"},{"vendor":"grafana","product":"grafana oss","name":"Grafana OSS","label":"grafana oss","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 13.0.0, < 13.0.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.1.0, < 13.1.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.2.0, < 13.2.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 13.0.0, < 13.0.11 | ≥ 13.1.0, < 13.1.8 | ≥ 13.2.0, < 13.2.4","eol":null,"hubHref":"/vendor/grafana/grafana_oss"},{"vendor":"grafana","product":"nanogit","name":"Nanogit","label":"nanogit","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.7.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.0","eol":null,"hubHref":"/vendor/grafana/nanogit"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-95502","label":"grafana.com/security/security-advisories/cve-2026-95502","hostname":"grafana.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":["CVE-2026-61801","RHSA-2026:85544"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-13T17:05:49.670Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-13T19:31:30.373Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T14:26:36.591Z","stale":false,"partial":false}}