ALSA-2026:99020: Important: grafana-pcp security update

Q: What kind of input can trigger the issue?

The issue is a denial of service caused by crafted Zstandard-compressed input processed by github.com/klauspost/compress/zstd.

Q: Which component should be updated?

The advisory identifies the grafana-pcp package for AlmaLinux as affected and provides a security update for it.

Published Nov 11, 2026

Updated

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input (CVE-2026-116591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

1 affected componentFixes available

almalinux/grafana-pcp<5.1.1-20.el8_10

5.1.1-20.el8_10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/grafana-pcp to a version that resolves this vulnerability.
Fixed in 5.1.1-20.el8_10

Event History

Nov 11, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116591

Frequently Asked Questions

What kind of input can trigger the issue?