High ELSA-2026-35827 1 CVE

Important: grafana security update (Oracle Linux 10)

Published Jul 16, 2026 · Updated Jul 16, 2026

Ecosystem: Oracle Linux

Summary

[10.2.6-27]
- Resolves: RHEL-183694: CVE-2026-39821

[10.2.6-26]
- Resolves RHEL-161791: CVE-2026-27877
- Resolves RHEL-166459: CVE-2026-32282
- Resolves RHEL-167494: CVE-2026-32283

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 10	grafana	0:10.2.6-27.el10_2
Oracle Linux · 10	grafana-selinux	0:10.2.6-27.el10_2

Vulnerabilities 1

Critical 9.6

CVE-2026-39821

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

Go standard library golang.org/x/net net/http net/http/internal/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go

May 22, 2026