RHSA-2026:99152: Important: grafana-pcp security update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.Security Fix(es): github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input (CVE-2026-116591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/grafana-pcpto a version that resolves this vulnerability.Fixed in 5.1.1-17.el9_8.3 - Upgrade
Upgrade
redhat/grafana-pcp-debuginfoto a version that resolves this vulnerability.Fixed in 5.1.1-17.el9_8.3 - Upgrade
Upgrade
redhat/grafana-pcp-debugsourceto a version that resolves this vulnerability.Fixed in 5.1.1-17.el9_8.3 - Upgrade
Upgrade
redhat/grafana-pcpto a version that resolves this vulnerability.Fixed in 5.1.1-17.el9_8.3.aa - Upgrade
Upgrade
redhat/grafana-pcp-debuginfoto a version that resolves this vulnerability.Fixed in 5.1.1-17.el9_8.3.aa - Upgrade
Upgrade
redhat/grafana-pcp-debugsourceto a version that resolves this vulnerability.Fixed in 5.1.1-17.el9_8.3.aa
Event History
Frequently Asked Questions
Which installed packages should be checked when assessing exposure?
The advisory lists redhat/grafana-pcp, redhat/grafana-pcp-debuginfo, and redhat/grafana-pcp-debugsource.
What does an attacker need to trigger the issue?
The issue is described as a denial of service via crafted Zstandard-compressed input. The provided data does not specify an authentication requirement or any particular Grafana-PCP configuration needed for exploitation.