This advisory covers three security vulnerabilities affecting Grafana in Red Hat Enterprise Linux 9.4 EUS, all related to underlying Go language libraries. CVE-2025-61729 is a denial of service vulnerability caused by excessive resource consumption when processing crafted certificates in crypto/x509. CVE-2025-61728 involves excessive CPU usage when building archive indexes in archive/zip. CVE-2025-61726 causes memory exhaustion during query parameter parsing in net/url. These issues can be exploited to cause denial of service conditions by exhausting system resources. Red Hat has released updated Grafana packages that include fixes for these vulnerabilities.

Successful exploitation of these vulnerabilities can cause denial of service through excessive CPU or memory consumption, potentially impacting availability of Grafana services on affected Red Hat Enterprise Linux 9.4 systems. There are no known exploits in the wild at this time. The vulnerabilities do not indicate privilege escalation or data confidentiality impacts based on the advisory.

Red Hat has released updated Grafana packages for Red Hat Enterprise Linux 9.4 Extended Update Support that address these vulnerabilities. Users should apply the provided security update as detailed in Red Hat advisory RHSA-2026:3835 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated by the vendor.