Skip to content
OpenAdvisories
High RLSA-2026:46391 1 CVE

Important: grafana security, bug fix, and enhancement update

Published Jul 28, 2026 · Updated Jul 28, 2026

Ecosystem: Rocky Linux

Summary

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)

Bug Fix(es) and Enhancement(s):

* [grafana / rhel-8.10.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188279)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 grafana 0:9.2.10-32.el8_10

Vulnerabilities 1

  • Medium 6.5
    CVE-2026-44740

    go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

    Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumptio…

    go-git go-billy scorecard kyverno-cli-1.17 Debian Ubuntu Wolfi Go

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2483894