Critical Security Update for Grafana: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:3188: Important: grafana security update. Affects grafana versions < 9.2.10-28.el8_10. Fixed in 9.2.10-28.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grafana is an open-source platform designed for monitoring and visualizing metrics from various data sources such as Graphite, InfluxDB, and OpenTSDB. It is widely used for creating dashboards and graphs, enabling users to gain insights from their data. However, recent vulnerabilities have been identified that could potentially impact system performance and security.
Vulnerability Detail
The vulnerabilities in Grafana stem from issues in its underlying libraries. Specifically, CVE-2025-61728 relates to excessive CPU consumption when building archive indexes in the archive/zip package, which could lead to denial of service. CVE-2025-61726 involves memory exhaustion during query parameter parsing in the net/url package, potentially causing applications to crash. Lastly, CVE-2025-68121 addresses unexpected session resumption in the crypto/tls package, which could allow unauthorized access to secure sessions. These vulnerabilities highlight the importance of timely updates to maintain system integrity and performance.
How To Fix
Minimum fixed version
9.2.10-28.el8_10
This is the first release that contains the fix.
sudo dnf update grafanaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the resources allocated to Grafana or disable certain features that may trigger the vulnerabilities until the update is applied. However, the most effective solution is to perform the update as soon as possible.
Conclusion
The identified vulnerabilities in Grafana necessitate immediate attention to ensure the security and performance of systems utilizing this platform. By updating to the latest patched versions and considering temporary workarounds, users can mitigate potential risks effectively.
See every vulnerability recorded for grafana →
FAQ
The main vulnerabilities include excessive CPU consumption, memory exhaustion, and unexpected session resumption, as detailed in CVEs 2025-61728, 2025-61726, and 2025-68121.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, consider limiting resource allocation or disabling features that may trigger the vulnerabilities until you can apply the patch.
While specific exploits may not be publicly available, the vulnerabilities pose significant risks, including denial of service and unauthorized access, making it crucial to apply updates promptly.
For detailed information, refer to the CVE pages linked in the advisory, which provide insights into the vulnerabilities, their impacts, and mitigation strategies.
Related vulnerabilities
Recent vulnerabilities recorded for grafana.
