Red Hat Product Errata RHSA-2026:67517 - Security Advisory Issued: 2026-09-15 Updated: 2026-09-15 RHSA-2026:67517 - Security Advisory Overview Updated Packages Synopsis Important: grafana security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for grafana is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377) grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376) golang.org/x/net/idna: golang: net/ http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502) grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads (CVE-2026-42127) grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609) grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382) encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) net/ http: golang: Go net/ http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64 Fixes BZ - 2445345 - CVE-2026-27137 crypto/x509: Incorrect enforcement of email constraints in crypto/x509 BZ - 2456335 - CVE-2026-33810 crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application BZ - 2467809 - CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing BZ - 2467820 - CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs BZ - 2477246 - CVE-2026-33377 grafana: Grafana: Privilege escalation via dashboard overwrite BZ - 2477262 - CVE-2026-33376 grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default BZ - 2480756 - CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing BZ - 2480757 - CVE-2026-27136 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass BZ - 2480761 - CVE-2026-25681 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting BZ - 2480762 - CVE-2026-42502 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering BZ - 2499061 - CVE-2026-8609 grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route BZ - 2499062 - CVE-2026-33382 grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal BZ - 2515820 - CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution BZ - 2515827 - CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service BZ - 2515838 - CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages BZ - 2515840 - CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVEs CVE-2026-8609 CVE-2026-25681 CVE-2026-27136 CVE-2026-27137 CVE-2026-33376 CVE-2026-33377 CVE-2026-33382 CVE-2026-33810 CVE-2026-33818 CVE-2026-39820 CVE-2026-39821 CVE-2026-42127 CVE-2026-42499 CVE-2026-42502 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 SRPM grafana-10.2.6-26.el10_0.src.rpm SHA-256: 182a05392b1f6bf434b0e574e15501b5484349cbaac0af70c0abe3dc2f87aeec x86_64 grafana-10.2.6-26.el10_0.x86_64.rpm SHA-256: 14ff641f940fb7f36bbcecaf204cb69853b9a20be44c172f85f34a23e49eab07 grafana-debuginfo-10.2.6-26.el10_0.x86_64.rpm SHA-256: bd500dc021560ccdda229f455656807730a7c77cb0c2a1e0b1f179e63faad399 grafana-debugsource-10.2.6-26.el10_0.x86_64.rpm SHA-256: 1191b42f8c7547d30ad8b5b1c399ca4327cc5e26c75a95813d812a1ac4ee5254 grafana-selinux-10.2.6-26.el10_0.x86_64.rpm SHA-256: 3cbb8a0aa55f3d5cb9a082a93b5ce18e5eaeffae72d9e94bc97439f7ec17369f Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 SRPM grafana-10.2.6-26.el10_0.src.rpm SHA-256: 182a05392b1f6bf434b0e574e15501b5484349cbaac0af70c0abe3dc2f87aeec s390x grafana-10.2.6-26.el10_0.s390x.rpm SHA-256: c499b5cf2b52003ab711d43a644555372e8be28969c5f1bd560c42e802643028 grafana-debuginfo-10.2.6-26.el10_0.s390x.rpm SHA-256: fb3e3242db1141694c9f374dc196f0fadcbefc6347644b7f09211e846d09f728 grafana-debugsource-10.2.6-26.el10_0.s390x.rpm SHA-256: 58eb553916743f00f7ee5b10827528c82200c6d696498ff5db60474e568e9db3 grafana-selinux-10.2.6-26.el10_0.s390x.rpm SHA-256: 3e65111598160aeb2a88355fe2430ece43294461adcb6edac9bbef6912fea5d3 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 SRPM grafana-10.2.6-26.el10_0.src.rpm SHA-256: 182a05392b1f6bf434b0e574e15501b5484349cbaac0af70c0abe3dc2f87aeec ppc64le grafana-10.2.6-26.el10_0.ppc64le.rpm SHA-256: d6a326099fe3f970a433329078e9dbd418723353f8938c7a3c0a24638eae08a2 grafana-debuginfo-10.2.6-26.el10_0.ppc64le.rpm SHA-256: 545ed76b8c694d5daaf9c5c17ea83305313a3c246d39b4031771008591a1d344 grafana-debugsource-10.2.6-26.el10_0.ppc64le.rpm SHA-256: 8d12ac0cc36b77b160d2cb4e92075e9f42e1391761c13bce50459cd701109b72 grafana-selinux-10.2.6-26.el10_0.ppc64le.rpm SHA-256: 4af0b007edf118dd7a7e3dee480c1c0e88d8132d0bbbcbe5d7dd8cbb46704594 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 SRPM grafana-10.2.6-26.el10_0.src.rpm SHA-256: 182a05392b1f6bf434b0e574e15501b5484349cbaac0af70c0abe3dc2f87aeec aarch64 grafana-10.2.6-26.el10_0.aarch64.rpm SHA-256: 32edfb7dcd812327bf54e9c4f4985409db4bbc7111525db3affa329181450557 grafana-debuginfo-10.2.6-26.el10_0.aarch64.rpm SHA-256: e43b57349cb6231201b9cda768c175a0cf2abf7f3b7c81be365782b7f749fb3d grafana-debugsource-10.2.6-26.el10_0.aarch64.rpm SHA-256: 3a7e68eec127922d833923dee484f1cdb0ce8cea3c809f279a41d6701c17828c grafana-selinux-10.2.6-26.el10_0.aarch64.rpm SHA-256: 1e3d964fcc6ad8c451eeeb13957af8228b55423d8635d5c26eefcce56ffcd5dc Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 SRPM grafana-10.2.6-26.el10_0.src.rpm SHA-256: 182a05392b1f6bf434b0e574e15501b5484349cbaac0af70c0abe3dc2f87aeec aarch64 grafana-10.2.6-26.el10_0.aarch64.rpm SHA-256: 32edfb7dcd812327bf54e9c4f4985409db4bbc7111525db3affa329181450557 grafana-debuginfo-10.2.6-26.el10_0.aarch64.rpm SHA-256: e43b57349cb6231201b9cda768c175a0cf2abf7f3b7c81be365782b7f749fb3d grafana-debugsource-10.2.6-26.el10_0.aarch64.rpm SHA-256: 3a7e68eec127922d833923dee484f1cdb0ce8cea3c809f279a41d6701c17828c grafana-selinux-10.2.6-26.el10_0.aarch64.rpm SHA-256: 1e3d964fcc6ad8c451eeeb13957af8228b55423d8635d5c26eefcce56ffcd5dc Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 SRPM grafana-10.2.6-26.el10