This advisory covers two security issues in Grafana as packaged for Red Hat Enterprise Linux 9.4 EUS. CVE-2025-22871 is a request smuggling vulnerability in the net/http package caused by acceptance of invalid chunked data, which could allow an attacker to interfere with HTTP request processing. CVE-2025-4123 is a cross-site scripting (XSS) vulnerability in Grafana that arises through custom frontend plugins and an open redirect flaw, potentially enabling attackers to execute arbitrary scripts in the context of the victim's browser. Red Hat has released updated Grafana packages to address these issues.

If exploited, CVE-2025-22871 could allow an attacker to perform HTTP request smuggling, potentially leading to unauthorized request manipulation. CVE-2025-4123 could enable attackers to conduct cross-site scripting attacks via malicious custom frontend plugins or open redirect vectors, potentially compromising user sessions or executing arbitrary scripts. The advisory rates the overall security impact as important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated Grafana packages for Red Hat Enterprise Linux 9.4 Extended Update Support that fix these vulnerabilities. Users should apply the available security update as described in the Red Hat advisory RHSA-2025:8665 and the referenced update article (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated beyond applying the official update.