RLSA-2026:97553: Important: grafana-pcp security, bug fix, and enhancement update

Q: Which components in this update are associated with the security fixes?

The listed fixes affect Go's crypto/x509 certificate validation and certificate-chain building code. They are included in the Rocky Linux grafana-pcp update.

Q: What could an attacker need to exploit the certificate validation issue?

The advisory assigns the combined severity vector AV:N/AC:L/PR:N/UI:R, indicating network reachability, low attack complexity, no required privileges, and required user interaction. The advisory does not specify the exact interaction or deployment conditions.

Q: Is there a workaround if the update cannot be installed immediately?

No workaround or mitigation is provided in the advisory. The available remediation is to apply the grafana-pcp update containing the listed security fixes.

Q: How can I identify systems that need review?

Review Rocky Linux systems using the grafana-pcp package, particularly where its Grafana datasources or related functionality are deployed. The advisory does not provide affected or fixed package version numbers.

Published Nov 11, 2026

Updated

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

Bug Fix(es) and Enhancement(s):

[grafana-pcp / rhel-9.9] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188286)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Affected Software

1 affected componentFixes available

rocky-linux/grafana-pcp<0:5.1.1-17.el9_8

0:5.1.1-17.el9_8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/grafana-pcp to a version that resolves this vulnerability.
Fixed in 0:5.1.1-17.el9_8

Event History

Nov 11, 2026

Advisory Published

via OSV·12:04 AM

Data Sourced

via OSV·12:04 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which components in this update are associated with the security fixes?

The listed fixes affect Go's crypto/x509 certificate validation and certificate-chain building code. They are included in the Rocky Linux grafana-pcp update.

What could an attacker need to exploit the certificate validation issue?

The advisory assigns the combined severity vector AV:N/AC:L/PR:N/UI:R, indicating network reachability, low attack complexity, no required privileges, and required user interaction. The advisory does not specify the exact interaction or deployment conditions.

Is there a workaround if the update cannot be installed immediately?

No workaround or mitigation is provided in the advisory. The available remediation is to apply the grafana-pcp update containing the listed security fixes.

How can I identify systems that need review?

Review Rocky Linux systems using the grafana-pcp package, particularly where its Grafana datasources or related functionality are deployed. The advisory does not provide affected or fixed package version numbers.

RLSA-2026:97553: Important: grafana-pcp security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which components in this update are associated with the security fixes?

What could an attacker need to exploit the certificate validation issue?

Is there a workaround if the update cannot be installed immediately?

How can I identify systems that need review?

Company

Resources

Contact

Frequently Asked Questions

Which components in this update are associated with the security fixes?

What could an attacker need to exploit the certificate validation issue?

Is there a workaround if the update cannot be installed immediately?

How can I identify systems that need review?