Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9 enterprise_linux:9::appstream | grafana | 0:10.2.6-24.el9_9.8 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | grafana-debuginfo | 0:10.2.6-24.el9_9.8 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | grafana-debugsource | 0:10.2.6-24.el9_9.8 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | grafana-selinux | 0:10.2.6-24.el9_9.8 |
Vulnerabilities 2
-
High 8.7
compress zstd: Panic on two-block frames
compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768.…
-
High 7.7
Azure Monitor access token disclosure via SSRF
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2554113
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2561461
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98541.json
-
report
https://access.redhat.com/security/cve/CVE-2026-88967
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-88967
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-88967
-
report
https://access.redhat.com/security/cve/CVE-2026-116591
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-116591
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-116591
-
article
https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d
-
article
https://github.com/klauspost/compress/releases/tag/v1.20.2
-
article
https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8