The Grafana plugin for Performance Co-Pilot includes datasources and dashboards for scalable time series and live metrics. It was found to contain multiple security vulnerabilities in underlying Go libraries: CVE-2025-61729 (crypto/x509) allows denial of service through excessive resource consumption with crafted certificates; CVE-2025-61726 (net/url) causes memory exhaustion during query parameter parsing; and CVE-2025-68121 (crypto/tls) involves unexpected session resumption. Red Hat released updated grafana-pcp packages for Red Hat Enterprise Linux 9.6 Extended Update Support to remediate these issues. The advisory references specific bugzilla entries and provides package updates for multiple architectures.

The vulnerabilities can lead to denial of service conditions due to resource exhaustion or unexpected behavior in TLS session handling when exploited. This could affect availability and potentially disrupt services relying on the grafana-pcp plugin. No known exploits in the wild have been reported. The impact is rated as important by Red Hat, corresponding to a high severity level.

Red Hat has released updated packages for grafana-pcp in Red Hat Enterprise Linux 9.6 Extended Update Support that address these vulnerabilities. Users should apply these official updates as described in the Red Hat advisory RHSA-2026:3817 and the referenced article https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerabilities. No additional mitigation steps are indicated by the vendor.