This advisory covers two security flaws in Grafana as packaged for Red Hat Enterprise Linux 9.2. The first is a request smuggling vulnerability in the net/http package caused by acceptance of invalid chunked data (CVE-2025-22871). The second is a cross-site scripting (XSS) vulnerability in Grafana that can be triggered via custom frontend plugins and open redirect vectors (CVE-2025-4123). Red Hat has released updated Grafana packages (version 9.0.9-8.el9_2) that address these issues. The advisory references Red Hat's errata RHSA-2025:8680 and provides links for applying the update.

Successful exploitation of the request smuggling vulnerability could allow an attacker to interfere with HTTP request processing. The XSS vulnerability could enable attackers to execute arbitrary scripts in the context of the user's browser, potentially leading to session hijacking or other malicious actions. The advisory classifies the overall impact as Important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated Grafana packages (version 9.0.9-8.el9_2) that fix these vulnerabilities. Users should apply the provided security update as described in the Red Hat advisory RHSA-2025:8680 and the referenced update article (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated by the vendor beyond applying the update.