The advisory covers four security vulnerabilities impacting Grafana in Red Hat Enterprise Linux 9.6 EUS. CVE-2025-61729 is a denial of service caused by excessive resource consumption via crafted certificates in crypto/x509. CVE-2025-61728 involves excessive CPU consumption when building archive indexes in archive/zip. CVE-2025-61726 causes memory exhaustion during query parameter parsing in net/url. CVE-2025-68121 relates to unexpected session resumption in crypto/tls. These vulnerabilities stem from underlying Go language libraries used by Grafana. Red Hat has released updated Grafana packages (version 10.2.6-18.el9_6) that address these issues. The advisory applies to multiple architectures and variants of Red Hat Enterprise Linux 9.6 Extended Update Support and related update services.

The vulnerabilities can lead to denial of service conditions through excessive CPU or memory consumption or unexpected session resumption behavior, potentially disrupting Grafana service availability or security. No known exploits in the wild have been reported. The impact is rated as Important by Red Hat, indicating a high risk of service disruption or degraded performance if exploited.

Red Hat has released updated Grafana packages (version 10.2.6-18.el9_6) that fix these vulnerabilities. Users should apply the security update promptly by following Red Hat's update procedures as detailed in https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official patch. Patch status is confirmed by the vendor advisory.