Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. 

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: grafana security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat OpenShift Service Mesh 2.6.14, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.

Security Fix(es):
* istio-operator-rhel8: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* istio-cni-rhel8: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* pilot-rhel8: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* ratelimit-rhel8: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* istio-operator-rhel8: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* istio-cni-rhel8: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* pilot-rhel8: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* ratelimit-rhel8: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* istio-operator-rhel8: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* istio-cni-rhel8: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* pilot-rhel8: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* ratelimit-rhel8: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* istio-operator-rhel8: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* istio-cni-rhel8: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* pilot-rhel8: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* ratelimit-rhel8: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* istio-operator-rhel8: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* istio-cni-rhel8: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* pilot-rhel8: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* ratelimit-rhel8: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.6.14

Red Hat OpenShift Service Mesh 2.6.14, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.

Security Fix(es):

* proxyv2-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* proxyv2-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* proxyv2-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* proxyv2-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* proxyv2-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: yggdrasil security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. 

Security Fix(es):

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: go-toolset:rhel8 security update

The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: golang security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. 

Security Fix(es):

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: skopeo security update

The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted. 

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: containernetworking-plugins security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: golang-github-openprinting-ipp-usb security update

The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.

Search: CVE-2025-61726