The Grafana plugin for Performance Co-Pilot includes datasources and dashboards for monitoring scalable time series and live metrics. Three security vulnerabilities have been identified and fixed: CVE-2025-61729 is a denial of service in crypto/x509 due to excessive resource consumption from crafted certificates; CVE-2025-61726 is a memory exhaustion vulnerability in Go's net/url package during query parameter parsing; CVE-2025-68121 involves unexpected session resumption in crypto/tls. These vulnerabilities could lead to resource exhaustion or unexpected TLS behavior. Red Hat has issued an important security advisory (RHSA-2026:3816) with updated packages for affected Red Hat Enterprise Linux 10.0 Extended Update Support versions. The advisory includes instructions for applying the update and references for further details.

The vulnerabilities could allow denial of service conditions through excessive resource consumption or unexpected TLS session behavior, potentially impacting availability and security of systems running the affected grafana-pcp plugin on Red Hat Enterprise Linux 10.0 Extended Update Support. There are no known exploits in the wild at this time. The impact is rated as important by Red Hat Product Security.

Red Hat has released updated packages for grafana-pcp that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 10.0 Extended Update Support versions should apply the security update as described in the Red Hat advisory RHSA-2026:3816. For detailed instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.