Nanogit
Monthly
Memory exhaustion in Grafana's Git Sync (provisioning) feature allows a Git server under attacker control to drive Grafana into uncontrolled resource consumption by returning oversized or highly compressed responses during a provisioning fetch. Grafana OSS, Grafana Enterprise, and the grafana/nanogit client library are affected, but only instances where an administrator has explicitly enabled Git Sync and pointed it at an attacker-influenced Git server are exploitable - this is not a default configuration. Impact is availability-only (memory exhaustion / denial of service) with no confidentiality or integrity effect; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3 medium), and no public exploit identified at time of analysis.
Memory exhaustion in Grafana's Git Sync (provisioning) feature allows a Git server under attacker control to drive Grafana into uncontrolled resource consumption by returning oversized or highly compressed responses during a provisioning fetch. Grafana OSS, Grafana Enterprise, and the grafana/nanogit client library are affected, but only instances where an administrator has explicitly enabled Git Sync and pointed it at an attacker-influenced Git server are exploitable - this is not a default configuration. Impact is availability-only (memory exhaustion / denial of service) with no confidentiality or integrity effect; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3 medium), and no public exploit identified at time of analysis.