Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Grafana‑PCP plugin can cause server slowdown or crash
published 8 months ago
Summary
The Grafana Performance Co‑Pilot plugin on AlmaLinux may let a specially crafted request consume all memory or cause unexpected TLS session behavior, potentially disrupting the service. This can affect any system using the plugin’s data sources and dashboards. Install the latest Grafana‑PCP update as soon as possible to protect your environment.
What to do
- Update almalinux grafana-pcp to version 5.1.1-12.el8_10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | grafana-pcp |
< 5.1.1-12.el8_10 Fix: upgrade to 5.1.1-12.el8_10
|
Original advisory text
Important: grafana-pcp security update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.
Security Fix(es):
* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:3187 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-61726 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-68121 Third Party Advisory
- https://bugzilla.redhat.com/2434432 Third Party Advisory
- https://bugzilla.redhat.com/2437111 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2026-3187.html Vendor Advisory
Timeline
Published24 Feb 2026
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2026:3187 · OSV
Track software like this
Free during beta