{"id":"CLSA-2026-1788885695","summary":"grafana-pcp: Fix of 5 CVEs","details":"- rebuild with newer golang version 1.22.9-1.el9_2.tuxcare.els26 to fix the\n  following Go standard-library CVE's tracked for this package\n  - CVE-2026-33818: fix encoding/asn1 stack exhaustion by enforcing a recursion\n    depth limit in Unmarshal when parsing deeply nested structures\n  - CVE-2026-56858: fix html/template XSS where pathological input could close an\n    unescaped '/' early and inject attacker-controlled content\n  - CVE-2026-56860: fix net/url quadratic complexity when resolving relative paths\n    containing many '..' parent-directory segments\n  - CVE-2026-56862: fix crypto/tls denial of service from post-handshake KeyUpdate\n    messages forcing unbounded key-derivation work\n- the same golang rebuild also carries CVE-2026-56859 (encoding/xml unmarshal\n  depth-limit bypass via a custom UnmarshalXML), which is not tracked by these\n  tickets","modified":"2026-10-26T09:43:30.053492298Z","published":"2026-09-18T10:19:49Z","upstream":["CVE-2026-33818","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788885695.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32280"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862"}],"affected":[{"package":{"name":"grafana-pcp","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/grafana-pcp?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-1.el9_2.tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1788885695.json"}}],"schema_version":"1.9.0"}