Red Hat Security Advisory: grafana security update

Fixed packages 3

Vulnerabilities 14

• Critical 9.6
  CVE-2026-39821

  Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

  The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

  Go standard library golang.org/x/net net/http net/http/internal/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 22, 2026
• High 7.5
  CVE-2026-27137

  Incorrect enforcement of email constraints in crypto/x509

  When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 6, 2026
• High 7.5
  CVE-2026-33810

  Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

  When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issu…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• High 7.5
  CVE-2026-33818

  Enforce maximum recursion depth in encoding/asn1

  Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

  Go standard library encoding/asn1 katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• High 7.5
  CVE-2026-39820

  Quadratic string concatentation in consumeComment in net/mail

  Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

  Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-42499

  Quadratic string concatenation in consumePhrase in net/mail

  Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

  Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-42504

  Quadratic complexity in WordDecoder.DecodeHeader in mime

  Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

  Go standard library mime golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 2, 2026
• High 7.5
  CVE-2026-56853

  Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

  When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

  Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• High 7.5
  CVE-2026-56859

  Add recursion depth guard during decode in encoding/xml

  Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

  Go standard library encoding/xml golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• High 7.5
  CVE-2026-56862

  Limit handshake messages we are willing to accept post-handshake in crypto/tls

  Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key deriva…

  Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• High 7.4
  CVE-2026-33376

  Auth Proxy IPv6 whitelist bypass

  When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML,…

  Grafana Grafana OSS grafana grafana-12.4 Web / CMS Ubuntu Wolfi
  May 13, 2026
• High 7.1
  CVE-2026-33377

  Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

  An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

  Grafana Grafana OSS grafana grafana-12.4 Web / CMS Ubuntu Wolfi
  May 13, 2026
• Medium 6.1
  CVE-2026-56858

  Fix Javascript regexp context tracking in html/template

  Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

  Go standard library html/template katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• Medium 5.9
  CVE-2026-56860

  Avoid quadratic complexity in resolvePath in net/url

  Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte…

  Go standard library net/url katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2445345
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456335
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467809
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467820
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477246
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477262
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480756
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484204
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515815
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515820
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515827
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515838
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515839
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515840
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76809.json
• report
  https://access.redhat.com/security/cve/CVE-2026-27137
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27137
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27137
• article
  https://go.dev/cl/752182
• article
  https://go.dev/issue/77952
• article
  https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
• advisory
  https://pkg.go.dev/vuln/GO-2026-4599
• report
  https://access.redhat.com/security/cve/CVE-2026-33376
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33376
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33376
• article
  https://grafana.com/security/security-advisories/cve-2026-33376
• report
  https://access.redhat.com/security/cve/CVE-2026-33377
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33377
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33377
• article
  https://grafana.com/security/security-advisories/cve-2026-33377
• report
  https://access.redhat.com/security/cve/CVE-2026-33810
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33810
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33810
• article
  https://go.dev/cl/763763
• article
  https://go.dev/issue/78332
• article
  https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
• advisory
  https://pkg.go.dev/vuln/GO-2026-4866
• report
  https://access.redhat.com/security/cve/CVE-2026-33818