Red Hat Security Advisory: grafana-pcp security update

The Red Hat security advisory RHSA-2026:88189 addresses three security vulnerabilities in the grafana-pcp plugin for Performance Co-Pilot on Red Hat Enterprise Linux 8. The fixed issues include: CVE-2026-97031, a denial of service vulnerability in golang's crypto/tls caused by multiple ECH outer extension references; CVE-2026-78669, a denial of service vulnerability in golang's net/http/internal/http2 due to excessive HTTP/2 SETTINGS frames; and CVE-2026-111943, a man-in-the-middle attack vulnerability in golang's crypto/x509 due to acceptance of untrusted intermediate certificates. The advisory provides updated packages for multiple architectures and extended life cycle releases. The vendor advisory references detailed CVE pages for further information and instructions for applying the update.

Successful exploitation of these vulnerabilities could lead to denial of service conditions affecting the grafana-pcp plugin's operation or enable man-in-the-middle attacks by accepting untrusted intermediate certificates. This could disrupt monitoring and performance data collection or compromise secure communications. The advisory rates the overall impact as Important, indicating significant but not critical risk.

Red Hat has released updated packages for grafana-pcp in Red Hat Enterprise Linux 8 and its extended life cycle variants that address these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate the issues. No additional mitigation steps are indicated beyond applying the official update.