---
id: CVE-2026-95502
title: >-
  A Git server that Grafana's Git Sync (provisioning) is configured to use can
  exhaust Grafana's memory by returning oversized or highly compressed responses
  (uncontrolled resource consumption)
summary: >-
  A Git server that Grafana's Git Sync (provisioning) is configured to use can
  exhaust Grafana's memory by returning oversized or highly compressed responses
  (uncontrolled resource consumption). Exploitation requires an administrator to
  ha…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-409
  - CWE-770
vendor: Red Hat
product: Red Hat Enterprise Linux 8
affected:
  - multicluster_global_hub
  - advanced_cluster_management_for_kubernetes 2
  - ceph_storage 7
  - ceph_storage 8
  - ceph_storage 9
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
  - hardened_images
patched:
  - hardened_images
published: '2026-10-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:02:37.630'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95502'
references:
  - url: 'https://grafana.com/security/security-advisories/cve-2026-95502'
    label: security@grafana.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-95502.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-95502'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2550709'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-95502'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95502'
  - url: 'https://access.redhat.com/errata/RHSA-2026:76677'
  - url: 'https://access.redhat.com/errata/RHSA-2026:85544'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00372
epssPercentile: 0.30972
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T17:26:57.638487Z'
ingestedAt: '2026-10-13T18:41:42.745Z'
---

## Overview

A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, Red Hat Enterprise Linux 10, … · no fix planned: Red Hat Ceph Storage 9, Red Hat Enterprise Linux 9, Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-95502.json)
- **RHSA-2026:76677** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76677)
- **RHSA-2026:85544** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85544)