RHSA-2026:99171HighCVSS 7.5

Red Hat Security Advisory: grafana-pcp security update

Published
November 11, 2026
Last Modified
November 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-116591 →

📋 Description

CVE-2026-116591 — github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input

🎯 Affected products14

  • Red Hat Enterprise Linux AppStream EUS (v.10.2)
  • grafana-pcp-0:5.3.0-8.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.10.2)
  • grafana-pcp-0:5.3.0-8.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.10.2)
  • grafana-pcp-0:5.3.0-8.el10_2.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.10.2)
  • grafana-pcp-0:5.3.0-8.el10_2.3.src as a component of Red Hat Enterprise Linux AppStream EUS (v.10.2)
  • grafana-pcp-0:5.3.0-8.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.10.2)
  • grafana-pcp-debuginfo-0:5.3.0-8.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.10.2)
  • grafana-pcp-debuginfo-0:5.3.0-8.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.10.2)
  • grafana-pcp-debuginfo-0:5.3.0-8.el10_2.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.10.2)
  • grafana-pcp-debuginfo-0:5.3.0-8.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.10.2)
  • grafana-pcp-debugsource-0:5.3.0-8.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.10.2)
  • grafana-pcp-debugsource-0:5.3.0-8.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.10.2)
  • grafana-pcp-debugsource-0:5.3.0-8.el10_2.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.10.2)
  • grafana-pcp-debugsource-0:5.3.0-8.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.10.2)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. No direct configuration-level workaround exists within the library itself. --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce bounds on parsed count values and decode-table indices in klauspost/compress zstd decompression routines to prevent integer wraparound and out-of-bounds indexing: upgrade to klauspost/compress 1.20.2+ (or the corresponding fixed Red Hat builds), which reject counts exceeding math.MaxInt16 in readNCount, restrict Huffman-weight FSE tableLog values to 6 in huff0.ReadTable, and adjust count validation in validateNorm, closing crafted two-block zstd compressed stream. Until patched, this is a concern on applications decompressing untrusted Zstandard (zstd) input using klauspost/compress DecodeAll or streaming decoder, so reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer wraparound defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)

🔗 References (4)