Critical Security Update for grafana-pcp: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:3040: Important: grafana-pcp security update. Affects grafana-pcp versions < 5.1.1-12.el9_7. Fixed in 5.1.1-12.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grafana-pcp package is a Grafana plugin designed for Performance Co-Pilot, enabling users to visualize and analyze scalable time series data from various sources such as pmseries and Redis. It provides live metrics and dashboards that enhance monitoring capabilities. However, recent vulnerabilities have been identified that could compromise the security and stability of systems utilizing this package.
Vulnerability Detail
The grafana-pcp package has been found to have multiple vulnerabilities that could lead to severe security issues. These include a Denial of Service (DoS) due to excessive resource consumption from crafted certificates (CVE-2025-61729), memory exhaustion during query parameter parsing (CVE-2025-61726), and unexpected session resumption in TLS (CVE-2025-68121). Exploiting these vulnerabilities could result in service disruptions, data loss, or unauthorized access to sensitive information.
How To Fix
Minimum fixed version
5.1.1-12.el9_7
This is the first release that contains the fix.
sudo dnf update grafana-pcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of the grafana-pcp service by implementing network access controls or disabling the service until the update can be applied. Additionally, monitoring for unusual activity can help mitigate potential exploitation.
Conclusion
The grafana-pcp package has critical vulnerabilities that need immediate attention. Users are strongly advised to update to the latest patched version to ensure the security and stability of their systems. Implementing workarounds can provide temporary relief, but a full update is the best course of action.
See every vulnerability recorded for grafana-pcp →
FAQ
grafana-pcp is a Grafana plugin that integrates with Performance Co-Pilot to provide real-time visualization of performance metrics from various data sources.
The vulnerabilities include Denial of Service due to crafted certificates, memory exhaustion in query parameter parsing, and unexpected session resumption in TLS.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If an immediate update is not possible, consider implementing network access controls and monitoring for unusual activity as temporary workarounds.
For more details, refer to the CVE pages linked in the advisory, which provide in-depth information about each vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for grafana-pcp.
