[ALSA-2026:2920] Important: grafana security update
Type:
security
Severity:
important
Release date:
2026-02-19
Description:
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross?Dashboard Privilege Escalation (CVE-2026-21721) * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updated packages listed below:
Architecture Package Checksum
aarch64 grafana-selinux-10.2.6-18.el9_7.aarch64.rpm 39ebcfa29e3c971e3c798d798adca86d4fefef749943f808cfdee39fed1b1b39
aarch64 grafana-10.2.6-18.el9_7.aarch64.rpm 83d8e258e327650959e38ca365b805e7e1c84c395f6020c0af682cfd2001ec6a
ppc64le grafana-selinux-10.2.6-18.el9_7.ppc64le.rpm 6f1afb930d4c48982dca6be5f7ef089b0803e37aab821e1c3c3533266a31d783
ppc64le grafana-10.2.6-18.el9_7.ppc64le.rpm ff1e1b7d61475000cd1e3a03cc2a5938435f5e7d7e983cf87c2db95dbe67c733
s390x grafana-10.2.6-18.el9_7.s390x.rpm 1e6199c63d08f78eae0c88e53378e7da190b2035d1b871396cad22ba64c77f0e
s390x grafana-selinux-10.2.6-18.el9_7.s390x.rpm c1200f0fc85b5c961be5c36efbe8d02f88bb7568ddc48836b15e876ef6c1a8e1
x86_64 grafana-selinux-10.2.6-18.el9_7.x86_64.rpm 0d1239df5ebff601795d4d72f849809d1e0775ee5cbbf47de6535cb9773e0ec0
x86_64 grafana-10.2.6-18.el9_7.x86_64.rpm 3fb7c4a5eed8b8b0ceb2113a0592aac1de497490390fe9999dc53d4c17f665ca
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.