Grafana Security Update — AlmaLinux 9 (ALSA-2026:89744)

Type:

security

Severity:

critical

Release date:

2026-10-26

Description:

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)
* net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
* crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
* net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

• CVE-2026-111943
• CVE-2026-17183
• CVE-2026-78667
• CVE-2026-78669
• CVE-2026-97031
• RHSA-2026:89744
• ALSA-2026:89744

Updated packages listed below:

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.