A vulnerability (CVE-2026-25679, CVSS 7.5 HIGH) in the Grafana net/url library involves incorrect parsing of IPv6 host literals, which could be exploited to manipulate URL handling. The security update addresses this flaw in Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, specifically for the grafana-7.5.11-14.el9_0 package. Administrators should apply the provided update using the referenced Red Hat solution article.
Red Hat Product Errata RHSA-2026:8881 - Security Advisory Issued: 2026-04-20 Updated: 2026-04-20 RHSA-2026:8881 - Security Advisory Overview Updated Packages Synopsis Important: grafana security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for grafana is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0 s390x Fixes BZ - 2445356 - CVE-2026-25679 net/url: Incorrect parsing of IPv6 host literals in net/url CVEs CVE-2026-25679 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0 SRPM grafana-7.5.11-14.el9_0.src.rpm SHA-256: b5cee9a1afbe0557d5ad803d5c9828e67e46980fed39ad0b03ba0f0f044823b7 ppc64le grafana-7.5.11-14.el9_0.ppc64le.rpm SHA-256: 215d9f95711e72e35cf90159a326e285b5d2f270754f9fd8ceb97590caa099d0 grafana-debuginfo-7.5.11-14.el9_0.ppc64le.rpm SHA-256: 4e28ff72b270b554d03912a7c9e486e1389a5b13f46ab3cc1244c8c97964514a Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0 SRPM grafana-7.5.11-14.el9_0.src.rpm SHA-256: b5cee9a1afbe0557d5ad803d5c9828e67e46980fed39ad0b03ba0f0f044823b7 x86_64 grafana-7.5.11-14.el9_0.x86_64.rpm SHA-256: 6f1c10aa127299112312fc871112ac10d4e124b483ba04d463816117518721c4 grafana-debuginfo-7.5.11-14.el9_0.x86_64.rpm SHA-256: 7ca3c19f4f4c40122b36cb57e3def0e584b26672d08a5a8953c054adf19bd214 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0 SRPM grafana-7.5.11-14.el9_0.src.rpm SHA-256: b5cee9a1afbe0557d5ad803d5c9828e67e46980fed39ad0b03ba0f0f044823b7 aarch64 grafana-7.5.11-14.el9_0.aarch64.rpm SHA-256: ce062ff1cd3aa8488e41d32990a5119aaaac32f3f873bb74d4e7a1dcc6918855 grafana-debuginfo-7.5.11-14.el9_0.aarch64.rpm SHA-256: 29037f7e43b98fa0eb430049a70fd66a5f560cf5b82548027b9d83d9a84d1da6 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0 SRPM grafana-7.5.11-14.el9_0.src.rpm SHA-256: b5cee9a1afbe0557d5ad803d5c9828e67e46980fed39ad0b03ba0f0f044823b7 s390x grafana-7.5.11-14.el9_0.s390x.rpm SHA-256: d33e9d70eb01a3365db306a925cf866c661a2ebcb0a94fbd93b8884de18ad5c3 grafana-debuginfo-7.5.11-14.el9_0.s390x.rpm SHA-256: dfad43c568f4e17eef59c6946f8e1113336980adac958a392b83ed3a894fba41 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .