Red Hat issued security advisories RHSA-2026:46391 and RHSA-2026:32974 addressing several vulnerabilities including CVE-2026-44740, a denial of service flaw in the go-billy library used by Grafana. The issue arises from insufficient validation of crafted input, potentially allowing denial of service. The advisories provide updated RPM packages for Grafana version 9.2.10-32.el8_10 and syft version 1.46.0-0.1.hum1 for Red Hat Enterprise Linux 8 and Red Hat Hardened Images. The updates also include bug fixes and enhancements unrelated to security. No known exploits in the wild have been reported. The advisories cover multiple CPU architectures and extended life cycle versions of Red Hat Enterprise Linux 8.

The primary impact is a denial of service condition caused by insufficient input validation in the go-billy library component used by Grafana. This could allow an attacker to disrupt service availability. The security impact is rated Important by Red Hat. No active exploitation has been reported. Other fixes and enhancements included in the updates do not have specified security impacts.

Red Hat has released updated RPM packages for Grafana (version 9.2.10-32.el8_10) and syft (version 1.46.0-0.1.hum1) addressing the vulnerabilities. Users should apply these official updates as per Red Hat's guidance available at https://access.redhat.com/articles/11258 and https://images.redhat.com/. No additional mitigation steps are indicated by Red Hat. Patch status is confirmed as official fix.