Red Hat Security Advisory: grafana security update

Fixed packages 4

Vulnerabilities 6

• Critical 9.6
  CVE-2026-39821

  Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

  The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

  Go standard library golang.org/x/net net/http net/http/internal/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 22, 2026
• High 7.5
  CVE-2026-39820

  Quadratic string concatentation in consumeComment in net/mail

  Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

  Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-42499

  Quadratic string concatenation in consumePhrase in net/mail

  Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

  Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 6.1
  CVE-2026-25681

  Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

  Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

  golang.org/x/net golang.org/x/net/html zot kots Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026
• Medium 6.1
  CVE-2026-27136

  Invoking duplicate attributes can cause XSS in golang.org/x/net/html

  Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

  golang.org/x/net golang.org/x/net/html zot kots Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026
• Medium 6.1
  CVE-2026-42502

  Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

  Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

  golang.org/x/net golang.org/x/net/html zot kots Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480756
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480757
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480761
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51112.json
• report
  https://access.redhat.com/security/cve/CVE-2026-25681
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-25681
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-25681
• article
  https://go.dev/cl/781703
• article
  https://go.dev/issue/79574
• article
  https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• advisory
  https://pkg.go.dev/vuln/GO-2026-5029
• report
  https://access.redhat.com/security/cve/CVE-2026-27136
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27136
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27136
• article
  https://go.dev/cl/781685
• article
  https://go.dev/issue/79575
• advisory
  https://pkg.go.dev/vuln/GO-2026-5030
• report
  https://access.redhat.com/security/cve/CVE-2026-39820
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467820
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-39820
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-39820
• article
  https://go.dev/cl/759940
• article
  https://go.dev/issue/78566
• article
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• advisory
  https://pkg.go.dev/vuln/GO-2026-4986
• report
  https://access.redhat.com/security/cve/CVE-2026-39821
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-39821
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-39821
• article
  https://go.dev/cl/767220
• article
  https://go.dev/issue/78760
• advisory
  https://pkg.go.dev/vuln/GO-2026-5026
• report
  https://access.redhat.com/security/cve/CVE-2026-42499
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467809
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42499
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42499
• article
  https://go.dev/cl/771520
• article
  https://go.dev/issue/78987
• advisory
  https://pkg.go.dev/vuln/GO-2026-4977