Summary
[10.2.6-28.9]
- Rebuild against updated golang
- Resolves RHEL-290737
[10.2.6-28.9]
- CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting
in Unified Alerting
- Resolves RHEL-290765
[10.2.6-28.8]
- Rebuild against updated golang
- Resolves RHEL-287475
- Resolves RHEL-279352
- Resolves RHEL-278978
- Resolves RHEL-278696
[10.2.6-28.7]
- Resolves RHEL-253142: CVE-2026-15815
[10.2.6-28.6]
- Resolves RHEL-261888: CVE-2026-84445
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | grafana | 0:10.2.6-28.el10_2.9 |
| Oracle Linux · 10 | grafana-selinux | 0:10.2.6-28.el10_2.9 |
Vulnerabilities 2
-
High 7.5
Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
-
High 7.1
CVE-2026-17183 CVE Record
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data ac…