Critical ELSA-2026-88354 3 CVEs

Critical: grafana-pcp security update (Oracle Linux 9)

Published Oct 22, 2026 · Updated Oct 22, 2026

Ecosystem: Oracle Linux

Summary

[5.1.1-17.2]
- Rebuild against updated golang
- Resolves RHEL-287511
- Resolves RHEL-279381
- Resolves RHEL-278739

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 9	grafana-pcp	0:5.1.1-17.el9_8.2

Vulnerabilities 3

High 7.5

CVE-2026-78669

Excessive CPU consumption from repeated initial window changes in net/http

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go

Oct 8, 2026
High 7.5

CVE-2026-97031

Reject malformed ECH outer extension references in crypto/tls

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and …

Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Oct 8, 2026
Medium 6.8

CVE-2026-111943 Public exploit

Distrust compromised intermediate certificates in crypto/x509

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…

Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go crates.io

Oct 21, 2026