RLSA-2026:98479: Important: grafana-pcp security update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.
Security Fix(es):
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/grafana-pcpto a version that resolves this vulnerability.Fixed in 0:5.1.1-17.el9_9.3 - Upgrade
Upgrade
rocky-linux/grafana-pcp-debuginfoto a version that resolves this vulnerability.Fixed in 0:5.1.1-17.el9_9.3 - Upgrade
Upgrade
rocky-linux/grafana-pcp-debugsourceto a version that resolves this vulnerability.Fixed in 0:5.1.1-17.el9_9.3
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which installed packages are covered by this advisory?
The advisory lists rocky-linux/grafana-pcp, rocky-linux/grafana-pcp-debuginfo, and rocky-linux/grafana-pcp-debugsource.
What attacker access is indicated by the supplied severity vector?
The supplied CVSS vector indicates network attackability, low attack complexity, no required privileges, and required user interaction. It indicates high confidentiality and integrity impact, with no availability impact in that vector.
Are the listed issues limited to denial of service?
No. The listed fixes also include a cross-site scripting issue in html/template and a man-in-the-middle issue involving untrusted intermediate certificates in crypto/x509.