The Grafana plugin for Performance Co-Pilot (grafana-pcp) includes data sources and dashboards for monitoring scalable time series and live metrics. Two security vulnerabilities have been identified and fixed in this plugin: CVE-2025-61729, a denial of service vulnerability in the crypto/x509 Go package caused by crafted certificates leading to excessive resource consumption; and CVE-2025-61726, a memory exhaustion vulnerability in the net/url Go package during query parameter parsing. These vulnerabilities could potentially be triggered by specially crafted inputs causing resource exhaustion. The Red Hat advisory RHSA-2026:3815 provides updated packages for Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Update Support variants to remediate these issues.

The vulnerabilities can lead to denial of service conditions through excessive resource consumption or memory exhaustion when processing crafted certificates or URL query parameters. This could degrade or disrupt the availability of services using the affected grafana-pcp plugin. There are no reports of active exploitation in the wild. The impact is primarily on service availability rather than data confidentiality or integrity.

Red Hat has released updated packages for grafana-pcp that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 8.4 variants should apply the security update as detailed in Red Hat advisory RHSA-2026:3815. The advisory provides instructions and package details for remediation. No additional mitigation steps are indicated by the vendor beyond applying the official update.