Critical Security Update for grafana-pcp: Denial of Service Vulnerability
Summary
ALSA-2026:1518: Important: grafana-pcp security update. Affects grafana-pcp versions < 5.1.1-11.el8_10. Fixed in 5.1.1-11.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grafana-pcp package is a Grafana plugin designed for Performance Co-Pilot, which facilitates the visualization of scalable time series data from various sources, including pmseries and Redis. It provides live metrics and dashboards that are essential for monitoring system performance. However, this package has been identified to have a significant security vulnerability that could lead to denial of service.
Vulnerability Detail
The vulnerability stems from the crypto/x509 component in Go, which is exploited through crafted certificates. This can lead to excessive resource consumption, potentially causing denial of service. The specific issue is tracked under CVE-2025-61729, which indicates that an attacker could leverage this vulnerability to disrupt service availability by overwhelming the system with resource-intensive operations.
How To Fix
Minimum fixed version
5.1.1-11.el8_10
This is the first release that contains the fix.
sudo dnf update grafana-pcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the use of the affected functionalities of the grafana-pcp plugin until the update is applied. This may involve disabling certain dashboards or data sources that utilize the vulnerable components.
Conclusion
The grafana-pcp package has a critical vulnerability that can lead to denial of service. It is essential to update to the patched version to ensure the security and availability of your monitoring systems. Utilize tools like Vulert to monitor for vulnerabilities in your applications effectively.
See every vulnerability recorded for grafana-pcp →
FAQ
The vulnerability allows for denial of service due to excessive resource consumption when processing crafted certificates.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability could lead to service outages, impacting the availability of critical monitoring dashboards and metrics.
Yes, you can temporarily limit the use of the affected functionalities or disable certain features until the update is applied.
For more details, refer to the CVE page for CVE-2025-61729, which provides in-depth information about the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for grafana-pcp.
