RLSA-2026:99020: Important: grafana-pcp security update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.
Security Fix(es):
github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input (CVE-2026-116591)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/grafana-pcpto a version that resolves this vulnerability.Fixed in 0:5.1.1-20.el8_10 - Upgrade
Upgrade
rocky-linux/grafana-pcp-debuginfoto a version that resolves this vulnerability.Fixed in 0:5.1.1-20.el8_10 - Upgrade
Upgrade
rocky-linux/grafana-pcp-debugsourceto a version that resolves this vulnerability.Fixed in 0:5.1.1-20.el8_10
Event History
Frequently Asked Questions
Which Rocky Linux packages should be checked?
Check for rocky-linux/grafana-pcp, rocky-linux/grafana-pcp-debuginfo, and rocky-linux/grafana-pcp-debugsource. The advisory does not provide affected or fixed package version numbers.
Does exploitation require authentication or user interaction?
The supplied CVSS vector indicates network attack access with low attack complexity, no privileges required, and no user interaction required. It rates the impact as high availability impact, with no confidentiality or integrity impact.
What component is associated with the denial-of-service issue?
The issue is identified in github.com/klauspost/compress/zstd and involves denial of service through crafted zstd-compressed input. The provided information does not specify which Grafana-PCP feature or configuration processes that input.