p PatchFirst

RLSA-2026:2914

RLSA-2026:2914 · Important: grafana security update

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross?Dashboard Privilege Escalation (CVE-2026-21721) * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVSS 8.1 · High · Fix available

Published
Updated

Stack: system · applications

Affected products and versions

  • grafana Rocky Linux:10

    Affected ranges
    • ECOSYSTEM: < 0:10.2.6-22.el10_1

    Update to 0:10.2.6-22.el10_1

Original sources

Check your server →