The Red Hat security advisory RHSA-2026:11514 addresses three vulnerabilities affecting the grafana-pcp package in Red Hat Enterprise Linux 8. These include CVE-2026-32282, where the Go internal syscall Root.Chmod function can follow symlinks outside the intended root directory, potentially leading to unauthorized file permission changes; CVE-2026-32283, a denial of service vulnerability triggered by multiple TLS 1.3 key update messages in Go's crypto/tls package; and CVE-2026-32280, a denial of service vulnerability in Go's certificate chain building within crypto/x509 and crypto/tls. The advisory provides updated packages to remediate these issues. The vulnerabilities are rated as important by Red Hat, though no CVSS scores are included in the advisory. The affected products include various architectures of Red Hat Enterprise Linux 8 and its extended life cycle releases. The advisory references Red Hat's article on applying updates for remediation.

The vulnerabilities can lead to denial of service conditions in systems using the affected grafana-pcp package due to flaws in Go's TLS implementation and certificate chain processing. Additionally, the Root.Chmod symlink issue could allow unauthorized changes to file permissions outside the intended root directory, potentially escalating privileges or compromising system integrity. These issues affect the security and stability of systems running the affected versions of Red Hat Enterprise Linux 8 with grafana-pcp installed.

Red Hat has released updated packages for grafana-pcp in Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update RHSA-2026:11514 promptly to remediate the issues. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.