This advisory covers two security issues in Grafana as packaged for Red Hat Enterprise Linux 9.2. The first is a request smuggling vulnerability in the net/http package caused by acceptance of invalid chunked data (CVE-2025-22871). The second is a cross-site scripting (XSS) vulnerability and an open redirect issue in Grafana via custom frontend plugins (CVE-2025-4123). Both vulnerabilities are addressed in updated Grafana packages provided by Red Hat. The advisory includes detailed package versions and SHA-256 checksums for verification.

Successful exploitation of CVE-2025-4123 could allow an attacker to perform cross-site scripting attacks or redirect users to malicious sites, potentially leading to session hijacking or phishing. CVE-2025-22871 could allow an attacker to perform HTTP request smuggling, which may lead to bypassing security controls or interfering with HTTP traffic processing. The advisory rates the overall impact as important, indicating significant but not critical risk. No known exploits in the wild have been reported.

Red Hat has released updated Grafana packages for Red Hat Enterprise Linux 9.2 that address these vulnerabilities. Users should apply these official updates as described in the Red Hat advisory (RHSA-2025:8680) and the referenced article https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires manual patching by system administrators. Patch status is confirmed by the vendor advisory.