The Grafana plugin for Performance Co-Pilot includes datasources and dashboards for scalable time series metrics. Multiple vulnerabilities were identified: CVE-2025-61729 involves denial of service due to excessive resource consumption triggered by crafted certificates in the crypto/x509 package; CVE-2025-61726 involves memory exhaustion in query parameter parsing within the golang net/url package; CVE-2025-68121 involves unexpected session resumption in the crypto/tls package. These vulnerabilities could lead to denial of service or unexpected behavior in TLS sessions. Red Hat has issued an important security advisory (RHSA-2026:3817) with updates for grafana-pcp in Red Hat Enterprise Linux 9.6 Extended Update Support and related distributions. The advisory includes fixes for these CVEs. No CVSS scores are provided in the advisory.

The vulnerabilities can cause denial of service conditions through excessive resource consumption or memory exhaustion, potentially impacting availability of services using the affected grafana-pcp plugin. The unexpected TLS session resumption vulnerability may cause unexpected or incorrect TLS session behavior, which could affect secure communications. There are no known exploits in the wild reported at this time.

Red Hat has released updated packages for grafana-pcp in Red Hat Enterprise Linux 9.6 Extended Update Support and related variants that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:3817 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.