RLSA-2026:97555: Important: grafana security, bug fix, and enhancement update

Q: Which components are addressed by this update?

The update addresses security issues in Go's crypto/x509 certificate validation and certificate-chain building, as well as the golang.org/x/net/html HTML parser. It also includes a Grafana packaging change for the RHEL 9.9 build.

Q: What attacker interaction is indicated by the supplied severity vector?

The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and user interaction required. It also indicates potential high confidentiality impact and low integrity and availability impact, with effects crossing a security scope boundary.

Q: How can I determine whether this advisory applies to my environment?

Check whether Grafana is installed from the Rocky Linux repository and compare the installed package against the updated package referenced by RLSA-2026:97555. The advisory identifies the affected software as rocky-linux/grafana.

Published Nov 11, 2026

Updated

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

Bug Fix(es) and Enhancement(s):

[grafana / rhel-9.9] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188281)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Affected Software

1 affected componentFixes available

rocky-linux/grafana<0:10.2.6-23.el9_8

0:10.2.6-23.el9_8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/grafana to a version that resolves this vulnerability.
Fixed in 0:10.2.6-23.el9_8

Event History

Nov 11, 2026

Advisory Published

via OSV·12:04 AM

Data Sourced

via OSV·12:04 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which components are addressed by this update?

The update addresses security issues in Go's crypto/x509 certificate validation and certificate-chain building, as well as the golang.org/x/net/html HTML parser. It also includes a Grafana packaging change for the RHEL 9.9 build.

What attacker interaction is indicated by the supplied severity vector?

The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and user interaction required. It also indicates potential high confidentiality impact and low integrity and availability impact, with effects crossing a security scope boundary.

How can I determine whether this advisory applies to my environment?

Check whether Grafana is installed from the Rocky Linux repository and compare the installed package against the updated package referenced by RLSA-2026:97555. The advisory identifies the affected software as rocky-linux/grafana.

RLSA-2026:97555: Important: grafana security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which components are addressed by this update?

What attacker interaction is indicated by the supplied severity vector?

How can I determine whether this advisory applies to my environment?

Company

Resources

Contact

Frequently Asked Questions

Which components are addressed by this update?

What attacker interaction is indicated by the supplied severity vector?

How can I determine whether this advisory applies to my environment?