Critical Security Update for grafana-pcp: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:3035: Important: grafana-pcp security update. Affects grafana-pcp versions < 5.3.0-2.el10_1. Fixed in 5.3.0-2.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grafana-pcp package is a Grafana plugin designed for Performance Co-Pilot, which provides data sources for scalable time series from pmseries and Redis, live PCP metrics, and bpftrace scripts from pmdabpftrace. It also includes several dashboards to visualize performance metrics. However, this package has been identified as vulnerable to several security issues that could lead to denial of service and memory exhaustion.
Vulnerability Detail
The vulnerabilities in grafana-pcp stem from issues in the underlying Golang libraries. Specifically, CVE-2025-61729 allows for denial of service due to excessive resource consumption via crafted certificates. CVE-2025-61726 can lead to memory exhaustion during query parameter parsing in the net/url package. Additionally, CVE-2025-68121 involves unexpected session resumption in the crypto/tls package, which can compromise secure communications. These vulnerabilities could allow attackers to disrupt service availability and exhaust system resources, potentially leading to application crashes.
How To Fix
Minimum fixed version
5.3.0-2.el10_1
This is the first release that contains the fix.
sudo dnf update grafana-pcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the exposure of the affected services by implementing network restrictions or using a firewall to block unauthorized access until the package is updated. Additionally, monitoring system resource usage can help identify potential denial of service attempts.
Conclusion
The grafana-pcp package has critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to maintain system security and prevent potential exploitation. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for grafana-pcp →
FAQ
Grafana-pcp is a plugin for Grafana that integrates with Performance Co-Pilot to provide real-time performance metrics and visualizations.
The main vulnerabilities include denial of service due to crafted certificates, memory exhaustion in query parsing, and unexpected session resumption in TLS communications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time.
Yes, you can implement network restrictions and monitor system resources to reduce the risk of exploitation until you can apply the necessary updates.
If immediate updates are not possible, ensure that your system is monitored for unusual activity and consider applying temporary workarounds to limit exposure.
Related vulnerabilities
Recent vulnerabilities recorded for grafana-pcp.
