Red Hat Security Advisory: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot in Red Hat Enterprise Linux 9.8 includes datasources and dashboards for time series and live metrics. This update fixes three security vulnerabilities: CVE-2026-97031, a denial of service in golang's crypto/tls via multiple ECH outer extension references; CVE-2026-78669, a denial of service in golang's net/http via excessive HTTP/2 SETTINGS frames; and CVE-2026-111943, a man-in-the-middle attack vector in golang's crypto/x509 due to untrusted intermediate certificates. These vulnerabilities could allow denial of service or interception of communications. Red Hat has released updated packages for multiple architectures and variants of RHEL 9.8 to remediate these issues.

The vulnerabilities can lead to denial of service conditions affecting services using the grafana-pcp plugin, potentially disrupting monitoring and metrics collection. The man-in-the-middle vulnerability could allow interception or tampering of communications relying on the affected crypto/x509 package. These impacts are rated critical by Red Hat Product Security.

Red Hat has released an official security update for the grafana-pcp plugin in Red Hat Enterprise Linux 9.8 Extended Update Support. Users should apply the update as detailed in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate these vulnerabilities. No additional mitigation steps are indicated beyond applying the official patch.