This Important security update for the grafana-pcp plugin addresses multiple vulnerabilities in its embedded Go components, including high-severity Denial of Service flaws in encoding/asn1 (CVE-2026-33818, CVSS 7.5) and net/http (CVE-2026-56853, CVSS 7.5), as well as medium-severity issues in net/url and other packages. The update applies to Red Hat Enterprise Linux 9.6 Extended Update Support and its variants; affected systems should apply the patch referenced in the Red Hat advisory.
Red Hat Product Errata RHSA-2026:67132 - Security Advisory Issued: 2026-09-14 Updated: 2026-09-14 RHSA-2026:67132 - Security Advisory Overview Updated Packages Synopsis Important: grafana-pcp security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for grafana-pcp is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) net/ http: golang: Go net/ http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64 Red Hat Enterprise Linux Server - AUS 9.6 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x Fixes BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal BZ - 2515820 - CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution BZ - 2515827 - CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service BZ - 2515838 - CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVEs CVE-2026-33818 CVE-2026-56853 CVE-2026-56858 CVE-2026-56860 CVE-2026-56862 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 SRPM grafana-pcp-5.1.1-15.el9_6.1.src.rpm SHA-256: 7a797847fc0c40d29162eaa1e02978e6e41768e3aba3a647a5eb4e4cbb875f58 x86_64 grafana-pcp-5.1.1-15.el9_6.1.x86_64.rpm SHA-256: 30f2d63919ed8cc3e989ed672ff0b8d6e4a7a62097445c852dfa826e2b57b817 grafana-pcp-debuginfo-5.1.1-15.el9_6.1.x86_64.rpm SHA-256: cfeb2659a06e53326c9c5a64619ed2db4f8d65c8316d65f5d8bbfff48cee95c8 grafana-pcp-debugsource-5.1.1-15.el9_6.1.x86_64.rpm SHA-256: e47ec2352c025ff22736f4e8eefdec74044d364e3fdfa64804f1651cda6a0884 Red Hat Enterprise Linux Server - AUS 9.6 SRPM grafana-pcp-5.1.1-15.el9_6.1.src.rpm SHA-256: 7a797847fc0c40d29162eaa1e02978e6e41768e3aba3a647a5eb4e4cbb875f58 x86_64 grafana-pcp-5.1.1-15.el9_6.1.x86_64.rpm SHA-256: 30f2d63919ed8cc3e989ed672ff0b8d6e4a7a62097445c852dfa826e2b57b817 grafana-pcp-debuginfo-5.1.1-15.el9_6.1.x86_64.rpm SHA-256: cfeb2659a06e53326c9c5a64619ed2db4f8d65c8316d65f5d8bbfff48cee95c8 grafana-pcp-debugsource-5.1.1-15.el9_6.1.x86_64.rpm SHA-256: e47ec2352c025ff22736f4e8eefdec74044d364e3fdfa64804f1651cda6a0884 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 SRPM grafana-pcp-5.1.1-15.el9_6.1.src.rpm SHA-256: 7a797847fc0c40d29162eaa1e02978e6e41768e3aba3a647a5eb4e4cbb875f58 s390x grafana-pcp-5.1.1-15.el9_6.1.s390x.rpm SHA-256: 04b8d747360ca5cb402c61ea7b6aa33e70e4ca64660a1e3799da08e96ecdbfd2 grafana-pcp-debuginfo-5.1.1-15.el9_6.1.s390x.rpm SHA-256: 08983bd0692d808f733f8499e96aad9e271c629587ebe0c36e6f91a920637b64 grafana-pcp-debugsource-5.1.1-15.el9_6.1.s390x.rpm SHA-256: 03079ac0b7bcfd3a7d894141852e11dfd54c4ca33430f2b47a759d22a57d7e82 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 SRPM grafana-pcp-5.1.1-15.el9_6.1.src.rpm SHA-256: 7a797847fc0c40d29162eaa1e02978e6e41768e3aba3a647a5eb4e4cbb875f58 ppc64le grafana-pcp-5.1.1-15.el9_6.1.ppc64le.rpm SHA-256: 896f6c6db319ad51ddd0e231e8a9acb54d003db3bb09a6232e5134d4cc3ca64b grafana-pcp-debuginfo-5.1.1-15.el9_6.1.ppc64le.rpm SHA-256: a91a2e32c62acd0128d70dab6d73f16f0a6fa36e5c193b7120778da436222125 grafana-pcp-debugsource-5.1.1-15.el9_6.1.ppc64le.rpm SHA-256: 715068e5a01cd5b3b87b4636a1e44225caac13c135cfb381b70d84fbc1a97532 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 SRPM grafana-pcp-5.1.1-15.el9_6.1.src.rpm SHA-256: 7a797847fc0c40d29162eaa1e02978e6e41768e3aba3a647a5eb4e4cbb875f58 aarch64 grafana-pcp-5.1.1-15.el9_6.1.aarch64.rpm SHA-256: 86dec990e33dff525a2b89e97b8acbd9c7292f46fa4717b6976b2ee2cd9583f2 grafana-pcp-debuginfo-5.1.1-15.el9_6.1.aarch64.rpm SHA-256: 73bdb7ce20e6a4479ba4bc154b6fedeb9471834fb32f3bb708f3812be4e63a92 grafana-pcp-debugsource-5.1.1-15.el9_6.1.aarch64.rpm SHA-256: ef6134af6fae6022a36df1f9c7ca55623dbd94b864f430d2cf7247edfe3e25a2 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 SRPM grafana-pcp-5.1.1-15.el9_6.1.src.rpm SHA-256: 7a797847fc0c40d29162eaa1e02978e6e41768e3aba3a647a5eb4e4cbb875f58 ppc64le grafana-pcp-5.1.1-15.el9_6.1.ppc64le.rpm SHA-256: 896f6c6db319ad51ddd0e231e8a9acb54d003db3bb09a6232e5134d4cc3ca64b grafana-pcp-debuginfo-5.1.1-15.el9_6.1.ppc64le.rpm SHA-256: a91a2e32c62acd0128d70dab6d73f16f0a6fa36e5c193b7120778da436222125 grafana-pcp-debugsource-5.1.1-15.el9_6.1.ppc64le.rpm SHA-256: 715068e5a01cd5b3b87b4636a1e44225caac13c135cfb381b70d84fbc1a97532 Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 SRPM grafana-pcp-5.1.1-15.el9_6.1.src.rpm SHA-256: 7a797847fc0c40d29162eaa1e02978e6e41768e3aba3a647a5eb4e4cbb875f58 x86_64 grafana-pcp-5.1.1-15.el9_6.1.x86_64.rpm SHA-256: 30f2d63919ed8cc3e989ed672ff0b8d6e4a7a62097445c852dfa826e2b57b817 grafana-pcp-debuginfo-5.1.1-15.el9_6.1.x86_64.rpm SHA-256: cfeb2659a06e53326c9c5a64619ed2db4f8d65c8316d65f5d8bbfff48cee95c8 grafana-pcp-debugsource-5.1.1-15.el9_6.1.x86_64.rpm SHA-256: e47ec2352c025ff22736f4e8eefdec74044d364e3fdfa64804f1651cda6a0884 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 SRPM grafana-pcp-5.1.1-15.el9_6.1.src.rpm SHA-256: 7a797847fc0c40d29162eaa1e02978e6e41768e3aba3a647a5eb4e4cbb875f58 aarch64 grafana-pcp-5.1.1-15.el9_6.1.aarch64.rpm SHA-256: 86dec990e33dff525a2b89e97b8acbd9c7292f46fa4717b6976b2ee2cd9583f2 grafana-pcp-debuginfo-5.1.1-15.el9_6.1.aarch64.rpm SHA-256: 73bdb7ce20e6a4479ba4bc154b6fedeb9471834fb32f3bb708f3812be4e63a92 grafana-pcp-debugsource-5.1.1-15.el9_6.1.aarch64.rpm SHA-256: ef6134af6fae6022a36df1f9c7ca55623dbd94b864f430d2cf7247edfe3e25a2 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 SRPM grafana-pcp-5.1.1-15.el9_6.1.src.rpm SHA-256: 7a797847fc0c40d29162eaa1e02978e6e41768e3aba3a647a5eb4e4cbb875f58 s390x grafana-pcp-5.1.1-15.el9_6.1.s390x.rpm SHA-256: 04b8d747360ca5cb402c61ea7b6aa33e70e4ca64660a1e3799da08e96ecdbfd2 grafana-pcp-debuginfo-5.1.1-15.el9_6.1.s390x.rpm SHA-256: 08983bd0692d808f733f8499e96aad9e271c629587ebe0c36e6f91a920637b64 grafana-pcp-debugsource-5.1.1-15.el9_6.1.s390x.rpm SHA-256: 03079ac0b7bcfd3a7d894141852e11dfd54c4ca33430f2b47a759d22a57d7e82 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 SRPM grafana-pcp-5.1.1-15.el9_6.1.src.rpm SHA-256: 7a797847fc0c40d29162eaa1e02978e6e41768e3aba3a647a5eb4e4cbb875f58 x86_64 grafana-pcp-5.1.1-15.el9_6.1.x86_64.rpm SHA-256: 30f2d63919ed8cc3e989ed672ff0b8d6e4a7a62097445c852dfa826e2b57b817 grafana-pcp-debuginfo-5.1.1-15.el9_6.1.x86_64.rpm SHA-256: cfeb2659a06e53326c9c5a64619ed2db4f8d65c8316d65f5d8bbfff48cee95c8 grafana-pcp-debugsource-5.1.1-15.el9_6.1.x86_64.rpm SHA-256: e47ec2352c025ff22736f4e8eefdec74044d364e3fdfa64804f1651cda6a0884 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 SRPM grafana-pcp-5.1.1-15.el9_6.1.src.rpm SHA-256: 7a797847fc0c40d29162eaa1e02978e6e41768e3aba3a647a5eb4e4cbb875f58 aarch64 grafana-pcp-5.1.1-15.el9_6.1.aarch64.rpm SHA-256: 86dec990e33dff525a2b89e97b8acbd9c7292f46fa4717b6976b2ee2cd9583f2 grafana-pcp-debuginfo-5.1.1-15.el9_6.1.aarch64.rpm SHA-256: 73bdb7ce20e6a4479ba4bc154b6fedeb9471834fb32f3bb708f3812be4e63a92 grafana-pcp-debugsource-5.1.1-15.el9_6.1.aarch64.rpm SHA-256: ef6134af6fae6022a36df1f9c7ca55623dbd94b864f430d2cf7247edfe3e25a2 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 SRPM grafana-pcp-5.1.1-15.el9_6.1.src.rpm SHA-256: 7a797847fc0c40d2