RHSA-2026:99171: Important: grafana-pcp security update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.Security Fix(es): github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input (CVE-2026-116591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/grafana-pcpto a version that resolves this vulnerability.Fixed in 5.3.0-8.el10_2.3 - Upgrade
Upgrade
redhat/grafana-pcp-debuginfoto a version that resolves this vulnerability.Fixed in 5.3.0-8.el10_2.3 - Upgrade
Upgrade
redhat/grafana-pcp-debugsourceto a version that resolves this vulnerability.Fixed in 5.3.0-8.el10_2.3 - Upgrade
Upgrade
redhat/grafana-pcpto a version that resolves this vulnerability.Fixed in 5.3.0-8.el10_2.3.aa - Upgrade
Upgrade
redhat/grafana-pcp-debuginfoto a version that resolves this vulnerability.Fixed in 5.3.0-8.el10_2.3.aa - Upgrade
Upgrade
redhat/grafana-pcp-debugsourceto a version that resolves this vulnerability.Fixed in 5.3.0-8.el10_2.3.aa
Event History
Frequently Asked Questions
What component is affected by this update?
The update applies to the Grafana plugin for Performance Co-Pilot, including its pmseries and Redis time-series datasources, live PCP metrics, pmdabpftrace scripts, and dashboards. The listed packages are grafana-pcp, grafana-pcp-debuginfo, and grafana-pcp-debugsource.
What attacker-controlled input is relevant to the reported issue?
The reported issue is a denial of service caused by crafted Zstandard-compressed input in github.com/klauspost/compress/zstd. The advisory does not state which Grafana PCP plugin feature, endpoint, or deployment configuration can receive such input.
How can I determine whether this advisory applies to my system?
Check whether grafana-pcp is installed. The advisory also lists grafana-pcp-debuginfo and grafana-pcp-debugsource, but it does not provide affected or fixed package versions.