Critical Security Update for Grafana: Denial of Service Vulnerability
Summary
ALSA-2026:1344: Important: grafana security update. Affects grafana versions < 9.2.10-27.el8_10. Fixed in 9.2.10-27.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grafana is an open-source analytics and monitoring platform that allows users to visualize and analyze metrics from various data sources like Graphite, InfluxDB, and OpenTSDB. It is widely used for creating dashboards and graphs to monitor system performance and health. However, a recent vulnerability has been identified that could lead to a Denial of Service (DoS) due to excessive resource consumption when processing crafted certificates.
Vulnerability Detail
The vulnerability, identified as CVE-2025-61729, originates from the crypto/x509 package in Golang, which is utilized by Grafana. This issue allows an attacker to craft a malicious certificate that, when processed by the Grafana server, can consume excessive resources, potentially leading to service downtime. The ramifications of this vulnerability can severely impact the availability of the Grafana service, making it crucial for users to address it promptly.
How To Fix
Minimum fixed version
9.2.10-27.el8_10
This is the first release that contains the fix.
sudo dnf update grafanaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the resources allocated to the Grafana service or implement network-level controls to restrict access to the Grafana server until the update can be applied.
Conclusion
In summary, the identified vulnerability in Grafana poses a significant risk of Denial of Service due to excessive resource consumption from crafted certificates. Users are strongly advised to update to the latest patched version to ensure the security and availability of their Grafana installations.
See every vulnerability recorded for grafana →
FAQ
CVE-2025-61729 is a vulnerability in the Golang crypto/x509 package used by Grafana, which can lead to Denial of Service due to excessive resource consumption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to service downtime, making Grafana unavailable for monitoring and analytics.
Yes, a patch is available in version 9.2.10-27.el8_10 of Grafana and grafana-selinux. Users should update to this version.
If you cannot update immediately, consider implementing resource limits or network controls to mitigate the risk until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for grafana.
