RHSA-2026:99020: Important: grafana-pcp security update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.Security Fix(es): github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input (CVE-2026-116591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/grafana-pcpto a version that resolves this vulnerability.Fixed in 5.1.1-20.el8_10 - Upgrade
Upgrade
redhat/grafana-pcp-debuginfoto a version that resolves this vulnerability.Fixed in 5.1.1-20.el8_10 - Upgrade
Upgrade
redhat/grafana-pcp-debugsourceto a version that resolves this vulnerability.Fixed in 5.1.1-20.el8_10 - Upgrade
Upgrade
redhat/grafana-pcpto a version that resolves this vulnerability.Fixed in 5.1.1-20.el8_10.aa - Upgrade
Upgrade
redhat/grafana-pcp-debuginfoto a version that resolves this vulnerability.Fixed in 5.1.1-20.el8_10.aa - Upgrade
Upgrade
redhat/grafana-pcp-debugsourceto a version that resolves this vulnerability.Fixed in 5.1.1-20.el8_10.aa
Event History
Frequently Asked Questions
Which packages are covered by this update?
The update covers redhat/grafana-pcp, redhat/grafana-pcp-debuginfo, and redhat/grafana-pcp-debugsource.
What input would an attacker need to use to trigger the issue?
The issue is a denial of service caused by crafted Zstandard (zstd) compressed input in github.com/klauspost/compress/zstd. The advisory does not state which Grafana PCP plugin interface or datasource could process such input.
Does the advisory identify affected configurations or a workaround if updates cannot be installed?
No. The provided advisory data does not identify affected default configurations, exposure conditions, or mitigations other than applying the security update.