Homepage

Out-of-bounds Read The advisory has been revoked - it doesn't affect any version of package grafana-pcp  (opens in a new tab)

Threat Intelligence

EPSS
0.33% (27th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-GRAFANAPCP-21855354
  • published2 Nov 2026
  • disclosed26 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 26 Oct 2026

NewCVE-2026-116591  (opens in a new tab)
CWE-125  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream grafana-pcp package and not the grafana-pcp package as distributed by RHEL.

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.

References