Critical Security Vulnerability in grafana-pcp: Denial of Service Risk
Summary
RLSA-2026:11881: Important: grafana-pcp security update. Affects grafana-pcp versions < 0:5.3.0-4.el10_1. Fixed in 0:5.3.0-4.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grafana-pcp package is a Grafana plugin designed for Performance Co-Pilot (PCP), which provides scalable time series data sources from pmseries and Redis, live metrics, and various dashboards. This plugin is integral for monitoring and visualizing performance metrics in real-time, making it essential for system administrators and developers. However, it is susceptible to a critical security vulnerability that could lead to service disruption.
Vulnerability Detail
The vulnerability identified as CVE-2026-32283 affects the Go crypto/tls package used in grafana-pcp. It allows for a Denial of Service (DoS) attack through the exploitation of multiple TLS 1.3 key update messages. An attacker could potentially disrupt the service by overwhelming the system with these messages, leading to a denial of access for legitimate users. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
0:5.3.0-4.el10_1
This is the first release that contains the fix.
sudo dnf update grafana-pcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the number of TLS connections or implementing rate limiting on your server to mitigate the risk of a DoS attack while waiting for the patch to be applied.
Conclusion
The grafana-pcp package has a critical vulnerability that can lead to Denial of Service attacks. It is crucial to update to the patched version to safeguard your systems. Implementing workarounds can help mitigate risks until the update is applied. Regular monitoring for vulnerabilities using tools like Vulert can enhance your security posture.
See every vulnerability recorded for grafana-pcp →
FAQ
CVE-2026-32283 is a security vulnerability in the grafana-pcp package that allows for Denial of Service attacks via multiple TLS 1.3 key update messages.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability has a CVSS score of 7.5, indicating it is of high severity and poses a significant risk to affected systems.
If an immediate update is not possible, consider implementing rate limiting on your server to reduce the risk of a Denial of Service attack.
For support, you can reach out to the Rocky Enterprise Software Foundation or consult the Red Hat support team for assistance.
Related vulnerabilities
Recent vulnerabilities recorded for grafana-pcp.
