CLSA-2026:1788279341

[CLSA-2026:1788279341] grafana: Fix of 11 CVEs

Type:

security

Severity:

Important

Release date:

2026-09-03 15:24:44 UTC

Description:

- CVE-2026-10601: reject path traversal in Loki resource paths and non-hexadecimal Tempo trace IDs
- CVE-2026-28376: limit Grafana Live push request bodies to 500 KiB
- CVE-2026-28379: synchronize managed-stream map reads
- CVE-2026-28383: limit plugin resource request bodies to 128 MiB

CVEs fixed:

CVE-2026-10601
CVE-2026-28376
CVE-2026-28379
CVE-2026-28383
CVE-2026-33818
CVE-2026-39820
CVE-2026-42499
CVE-2026-56858
CVE-2026-56859
CVE-2026-56860
CVE-2026-56862

Updated packages:

grafana-9.0.9-4.el9_2.alma.1.tuxcare.els21.x86_64.rpm
sha:a91fcf87108bbc7efb283053f7cc5828a401ad587f70eba947ff42d447d0f032

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.