{"api_version":"1","generated_at":"2026-10-22T06:53:29+00:00","cve":"CVE-2026-95502","urls":{"html":"https://cve.report/CVE-2026-95502","api":"https://cve.report/api/cve/CVE-2026-95502.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-95502","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-95502"},"summary":{"title":"Git Sync memory exhaustion via a malicious Git server","description":"A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.","state":"PUBLISHED","assigner":"GRAFANA","published_at":"2026-10-13 18:17:26","updated_at":"2026-10-16 20:02:37"},"problem_types":["CWE-409","CWE-770","CWE-770 CWE-770","CWE-409 CWE-409"],"metrics":[{"version":"3.1","source":"security@grafana.com","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-95502","name":"https://grafana.com/security/security-advisories/cve-2026-95502","refsource":"security@grafana.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-95502","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95502","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Grafana","product":"Nanogit","version":"affected 1.7.0 semver","platforms":[]},{"source":"CNA","vendor":"Grafana","product":"Grafana OSS","version":"affected 13.0.0 13.0.11 semver","platforms":[]},{"source":"CNA","vendor":"Grafana","product":"Grafana OSS","version":"affected 13.1.0 13.1.8 semver","platforms":[]},{"source":"CNA","vendor":"Grafana","product":"Grafana OSS","version":"affected 13.2.0 13.2.4 semver","platforms":[]},{"source":"CNA","vendor":"Grafana","product":"Grafana Enterprise","version":"affected 13.0.0 13.0.11 semver","platforms":[]},{"source":"CNA","vendor":"Grafana","product":"Grafana Enterprise","version":"affected 13.1.0 13.1.8 semver","platforms":[]},{"source":"CNA","vendor":"Grafana","product":"Grafana Enterprise","version":"affected 13.2.0 13.2.4 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"95502","cve":"CVE-2026-95502","epss":"0.003720000","percentile":"0.295430000","score_date":"2026-10-16","updated_at":"2026-10-17 00:14:15"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-95502","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-13T17:26:57.638487Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-13T19:31:30.373Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Nanogit","vendor":"Grafana","versions":[{"lessThan":"1.7.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThan":"13.0.11","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"13.1.8","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThan":"13.2.4","status":"affected","version":"13.2.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThan":"13.0.11","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"13.1.8","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThan":"13.2.4","status":"affected","version":"13.2.0","versionType":"semver"}]}],"datePublic":"2026-10-13T11:41:03.000Z","descriptions":[{"lang":"en","value":"A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server."}],"metrics":[{"cvssV3_1":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"CWE-770","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-409","description":"CWE-409","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-13T17:05:49.670Z","orgId":"57da9224-a3e2-4646-9d0e-c4dc2e05e7da","shortName":"GRAFANA"},"references":[{"tags":["vendor-advisory"],"url":"https://grafana.com/security/security-advisories/cve-2026-95502"}],"source":{"discovery":"INTERNAL_FINDING"},"title":"Git Sync memory exhaustion via a malicious Git server"}},"cveMetadata":{"assignerOrgId":"57da9224-a3e2-4646-9d0e-c4dc2e05e7da","assignerShortName":"GRAFANA","cveId":"CVE-2026-95502","datePublished":"2026-10-13T17:05:49.670Z","dateReserved":"2026-09-22T06:41:34.015Z","dateUpdated":"2026-10-13T19:31:30.373Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-13 18:17:26","lastModifiedDate":"2026-10-16 20:02:37","problem_types":["CWE-409","CWE-770","CWE-770 CWE-770","CWE-409 CWE-409"],"metrics":{"cvssMetricV31":[{"source":"security@grafana.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-13T17:26:57.638487Z","id":"CVE-2026-95502","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"95502","Ordinal":"1","Title":"Git Sync memory exhaustion via a malicious Git server","CVE":"CVE-2026-95502","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"95502","Ordinal":"1","NoteData":"A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.","Type":"Description","Title":"Git Sync memory exhaustion via a malicious Git server"}]}}}