Red Hat Security Advisory: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources and dashboards for scalable time series and live metrics. This update addresses three security issues: CVE-2026-97031, a denial of service vulnerability in golang's crypto/tls via multiple ECH outer extension references; CVE-2026-78669, a denial of service vulnerability in golang's net/http/internal/http2 via excessive HTTP/2 SETTINGS frames; and CVE-2026-111943, a man-in-the-middle attack vulnerability in golang's crypto/x509 due to untrusted intermediate certificates. These issues impact the grafana-pcp package distributed with Red Hat Enterprise Linux 10.2 and its Extended Update Support versions across multiple architectures. Red Hat has released updated packages to remediate these vulnerabilities.

Successful exploitation of these vulnerabilities could lead to denial of service conditions affecting services using the affected golang libraries within the grafana-pcp plugin, and man-in-the-middle attacks due to improper certificate validation. The denial of service vulnerabilities could disrupt service availability, while the man-in-the-middle vulnerability could compromise the integrity and confidentiality of communications. Red Hat rates the security impact as Important.

Red Hat has released updated grafana-pcp packages for Red Hat Enterprise Linux 10.2 and its Extended Update Support variants that address these vulnerabilities. Users should apply the provided security update as detailed in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate these issues. No additional mitigation steps are indicated beyond applying the official update.