{"id":"CVE-2026-95502","title":"A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption)","summary":"A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to ha…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-409","CWE-770"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","affected":["multicluster_global_hub","advanced_cluster_management_for_kubernetes 2","ceph_storage 7","ceph_storage 8","ceph_storage 9","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","hardened_images"],"patched":["hardened_images"],"published":"2026-10-13","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:02:37.630","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95502","references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-95502","label":"security@grafana.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-95502.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-95502"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550709"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-95502"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95502"},{"url":"https://access.redhat.com/errata/RHSA-2026:76677"},{"url":"https://access.redhat.com/errata/RHSA-2026:85544"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00372,"epssPercentile":0.30972,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-13T17:26:57.638487Z"},"ingestedAt":"2026-10-13T18:41:42.745Z","slug":"CVE-2026-95502","body":"## Overview\n\nA Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, Red Hat Enterprise Linux 10, … · no fix planned: Red Hat Ceph Storage 9, Red Hat Enterprise Linux 9, Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-95502.json)\n- **RHSA-2026:76677** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76677)\n- **RHSA-2026:85544** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85544)","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}