A vulnerability (CVE-2026-39821, CVSS 9.6 CRITICAL) in the golang `net/idna` library allows privilege escalation via incorrect Punycode label processing. This affects Grafana packages for Red Hat Enterprise Linux 10 that incorporate a vulnerable version of the Go library, specifically versions of `golang.org/x/net` prior to 0.55.0. The fix is included in the updated Grafana packages provided by Red Hat; administrators should apply the referenced security update for their specific RHEL 10 architecture.
Red Hat Product Errata RHSA-2026:35827 - Security Advisory Issued: 2026-07-06 Updated: 2026-07-06 RHSA-2026:35827 - Security Advisory Overview Updated Packages Synopsis Important: grafana security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for grafana is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2480756 - CVE-2026-39821 golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVEs CVE-2026-39821 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM grafana-10.2.6-27.el10_2.src.rpm SHA-256: 6808c4f9e83faf4a8d701b11112c0397e75997439a8e762dbee63d24e8aed24f x86_64 grafana-10.2.6-27.el10_2.x86_64.rpm SHA-256: 5b10fc59f472652642c9bb88543bcab913f6e79e1c47cec79b89d16c5cdfcac6 grafana-debuginfo-10.2.6-27.el10_2.x86_64.rpm SHA-256: 20dcf3543f7229652cce4799c633db28e631871b416518f1361aebeea8875d50 grafana-debugsource-10.2.6-27.el10_2.x86_64.rpm SHA-256: 375095e05a4b2f4874bf5f03e70d198736a95f9211cc8cb140105b7d8da1c884 grafana-selinux-10.2.6-27.el10_2.x86_64.rpm SHA-256: 11c17a1d9f81b7c58a3c6eba024375815112081a0c9f82c91b32326e7ecd1fac Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 SRPM grafana-10.2.6-27.el10_2.src.rpm SHA-256: 6808c4f9e83faf4a8d701b11112c0397e75997439a8e762dbee63d24e8aed24f x86_64 grafana-10.2.6-27.el10_2.x86_64.rpm SHA-256: 5b10fc59f472652642c9bb88543bcab913f6e79e1c47cec79b89d16c5cdfcac6 grafana-debuginfo-10.2.6-27.el10_2.x86_64.rpm SHA-256: 20dcf3543f7229652cce4799c633db28e631871b416518f1361aebeea8875d50 grafana-debugsource-10.2.6-27.el10_2.x86_64.rpm SHA-256: 375095e05a4b2f4874bf5f03e70d198736a95f9211cc8cb140105b7d8da1c884 grafana-selinux-10.2.6-27.el10_2.x86_64.rpm SHA-256: 11c17a1d9f81b7c58a3c6eba024375815112081a0c9f82c91b32326e7ecd1fac Red Hat Enterprise Linux for IBM z Systems 10 SRPM grafana-10.2.6-27.el10_2.src.rpm SHA-256: 6808c4f9e83faf4a8d701b11112c0397e75997439a8e762dbee63d24e8aed24f s390x grafana-10.2.6-27.el10_2.s390x.rpm SHA-256: 15a8c7577de62b5c4aa57b6922d72ee380220210f72f59a8590e813c32e75d94 grafana-debuginfo-10.2.6-27.el10_2.s390x.rpm SHA-256: c70a461ae33e3f0353f46192d3d4a51dc7497bed2817785ddbdd0fdada59625e grafana-debugsource-10.2.6-27.el10_2.s390x.rpm SHA-256: 9d9494ab68e59900c49ee57efde247a3a8aae33de2cabccc855691e180dd2659 grafana-selinux-10.2.6-27.el10_2.s390x.rpm SHA-256: 453619eb0f5b546c39a3aa80b149eb3bcbfb33bfaafda9316eff20d0ea8dd55e Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 SRPM grafana-10.2.6-27.el10_2.src.rpm SHA-256: 6808c4f9e83faf4a8d701b11112c0397e75997439a8e762dbee63d24e8aed24f s390x grafana-10.2.6-27.el10_2.s390x.rpm SHA-256: 15a8c7577de62b5c4aa57b6922d72ee380220210f72f59a8590e813c32e75d94 grafana-debuginfo-10.2.6-27.el10_2.s390x.rpm SHA-256: c70a461ae33e3f0353f46192d3d4a51dc7497bed2817785ddbdd0fdada59625e grafana-debugsource-10.2.6-27.el10_2.s390x.rpm SHA-256: 9d9494ab68e59900c49ee57efde247a3a8aae33de2cabccc855691e180dd2659 grafana-selinux-10.2.6-27.el10_2.s390x.rpm SHA-256: 453619eb0f5b546c39a3aa80b149eb3bcbfb33bfaafda9316eff20d0ea8dd55e Red Hat Enterprise Linux for Power, little endian 10 SRPM grafana-10.2.6-27.el10_2.src.rpm SHA-256: 6808c4f9e83faf4a8d701b11112c0397e75997439a8e762dbee63d24e8aed24f ppc64le grafana-10.2.6-27.el10_2.ppc64le.rpm SHA-256: e4c3d58394e37e2be602cd737349994183dda08e5a5ecd94a2f275e8f26926c0 grafana-debuginfo-10.2.6-27.el10_2.ppc64le.rpm SHA-256: 411fd69685395b92f329c7624c2c95356b9b5ea6e0194d686e4a4254af3442cb grafana-debugsource-10.2.6-27.el10_2.ppc64le.rpm SHA-256: b56089616481ae5f373d1cc2cbb57ac31fc0dbe7636c8fc828119d33d3f72c23 grafana-selinux-10.2.6-27.el10_2.ppc64le.rpm SHA-256: 39891c1f030254b93811bfa54a902c103ac74445aace055a3247d4c8a04f4870 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 SRPM grafana-10.2.6-27.el10_2.src.rpm SHA-256: 6808c4f9e83faf4a8d701b11112c0397e75997439a8e762dbee63d24e8aed24f ppc64le grafana-10.2.6-27.el10_2.ppc64le.rpm SHA-256: e4c3d58394e37e2be602cd737349994183dda08e5a5ecd94a2f275e8f26926c0 grafana-debuginfo-10.2.6-27.el10_2.ppc64le.rpm SHA-256: 411fd69685395b92f329c7624c2c95356b9b5ea6e0194d686e4a4254af3442cb grafana-debugsource-10.2.6-27.el10_2.ppc64le.rpm SHA-256: b56089616481ae5f373d1cc2cbb57ac31fc0dbe7636c8fc828119d33d3f72c23 grafana-selinux-10.2.6-27.el10_2.ppc64le.rpm SHA-256: 39891c1f030254b93811bfa54a902c103ac74445aace055a3247d4c8a04f4870 Red Hat Enterprise Linux for ARM 64 10 SRPM grafana-10.2.6-27.el10_2.src.rpm SHA-256: 6808c4f9e83faf4a8d701b11112c0397e75997439a8e762dbee63d24e8aed24f aarch64 grafana-10.2.6-27.el10_2.aarch64.rpm SHA-256: 44dd5f4c24729e4eaf61272d97e9b0eec994460dbdafe395b34697bfbea9f438 grafana-debuginfo-10.2.6-27.el10_2.aarch64.rpm SHA-256: 4da53e426d0d198710c5d046b796da0b3569eb3f20e7993c8e51a12d245d7db6 grafana-debugsource-10.2.6-27.el10_2.aarch64.rpm SHA-256: 8fbc4168188dfd4ac441576f19d37f70a3349278d43e76fd5c927880329f7c48 grafana-selinux-10.2.6-27.el10_2.aarch64.rpm SHA-256: 19d517ca9911a9faf493ffb5cbeebe9f82b8b6ce75ae1c142bc2066d2ef5638f Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 SRPM grafana-10.2.6-27.el10_2.src.rpm SHA-256: 6808c4f9e83faf4a8d701b11112c0397e75997439a8e762dbee63d24e8aed24f aarch64 grafana-10.2.6-27.el10_2.aarch64.rpm SHA-256: 44dd5f4c24729e4eaf61272d97e9b0eec994460dbdafe395b34697bfbea9f438 grafana-debuginfo-10.2.6-27.el10_2.aarch64.rpm SHA-256: 4da53e426d0d198710c5d046b796da0b3569eb3f20e7993c8e51a12d245d7db6 grafana-debugsource-10.2.6-27.el10_2.aarch64.rpm SHA-256: 8fbc4168188dfd4ac441576f19d37f70a3349278d43e76fd5c927880329f7c48 grafana-selinux-10.2.6-27.el10_2.aarch64.rpm SHA-256: 19d517ca9911a9faf493ffb5cbeebe9f82b8b6ce75ae1c142bc2066d2ef5638f Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 SRPM grafana-10.2.6-27.el10_2.src.rpm SHA-256: 6808c4f9e83faf4a8d701b11112c0397e75997439a8e762dbee63d24e8aed24f aarch64 grafana-10.2.6-27.el10_2.aarch64.rpm SHA-256: 44dd5f4c24729e4eaf61272d97e9b0eec994460dbdafe395b34697bfbea9f438 grafana-debuginfo-10.2.6-27.el10_2.aarch64.rpm SHA-256: 4da53e426d0d198710c5d046b796da0b3569eb3f20e7993c8e51a12d245d7db6 grafana-debugsource-10.2.6-27.el10_2.aarch64.rpm SHA-256: 8fbc4168188dfd4ac441576f19d37f70a3349278d43e76fd5c927880329f7c48 grafana-selinux-10.2.6-27.el10_2.aarch64.rpm SHA-256: 19d517ca9911a9faf493ffb5cbeebe9f82b8b6ce75ae1c142bc2066d2ef5638f Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 SRPM grafana-10.2.6-27.el10_2.src.rpm SHA-256: 6808c4f9e83faf4a8d701b11112c0397e75997439a8e762dbee63d24e8aed24f s390x grafana-10.2.6-27.el10_2.s390x.rpm SHA-256: 15a8c7577de62b5c4aa57b6922d72ee380220210f72f59a8590e813c32e75d94 grafana-debuginfo-10.2.6-27.el10_2.s390x.rpm SHA-256: c70a461ae33e3f0353f46192d3d4a51dc7497bed2817785ddbdd0fdada59625e grafana-debugsource-10.2.6-27.el10_2.s390x.rpm SHA-256: 9d9494ab68e59900c49ee57efde247a3a8aae33de2cabccc855691e180dd2659 grafana-selinux-10.2.6-27.el10_2.s390x.rpm SHA-256: 453619eb0f5b546c39a3aa80b149eb3bcbfb33bfaafda9316eff20d0ea8dd55e Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 SRPM grafana-10.2.6-27.el10_2.src.rpm SHA-256: 6808c4f9e83faf4a8d701b11112c0397e75997439a8e762dbee63d24e8aed24f ppc64le grafana-10.2.6-27.el10_2.ppc64le.rpm SHA-256: e4c3d58394e37e2be602cd737349994183dda08e5a5ecd94a2f275e8f26926c0 grafana-debuginfo-10.2.6-27.el10_2.ppc64le.rpm SHA-256: 411fd69685395b92f329c7624c2c95356b9b5ea6e0194d686e4a4254af3442cb grafana-debugsource-10.2.6-27.el10_2.ppc64le.rpm SHA-256: b56089616481ae5f373d1cc2cbb57ac31fc0dbe7636c8fc828119d33d3f72c23 grafana-selinux-10.2.6-27.el10_2.ppc64le.rpm SHA-256: 39891c1f030254b93811bfa54a902c103ac74445aace055a3247d4c8a04f4870 Red Hat Ente