Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.
Security Fix(es):
PCP: PCP: Remote denial of service and information leakage (CVE-2026-16530)
PCP: PCP: Arbitrary file creation via path traversal in pmproxy logger servlet (CVE-2026-16531)
Bug Fix(es) and Enhancement(s):
[Downstream] Rebase to the v7.1.3 or newer in 10.3 (JIRA:Rocky Linux-173456)
Cockpit reports "Metrics history could not be loaded" when some older pmlogger metrics are corrupted (JIRA:Rocky Linux-139714)
pcp-pmda-hdb and pcp-pmda-postgresql ship active default credentials in configuration files (JIRA:Rocky Linux-152221)
[Rocky Linux 10.2] PCP (pcp-zeroconf) now pulls a new set of additional packages that are not really required by default (JIRA:Rocky Linux-180384)
Remove legacy pcp-pmda-bcc package from Rocky Linux 10 and in favor of pcp-pmda-bpf (JIRA:Rocky Linux-188397)
Update of MSSQL PMDA to work with msodbcsql v18 (JIRA:Rocky Linux-177599)
Migrate to libvalkey from hiredis/hiredis-cluster (JIRA:Rocky Linux-108916)
pcp2openmetrics reports only the first metric when uses pmlogger archives (JIRA:Rocky Linux-114006)
pcp2opentelemetry generates output that is incompatible with OTLP/protobuf (JIRA:Rocky Linux-130463)
"opentelemetry.control.status_code" metric does not report failing scripts (JIRA:Rocky Linux-130499)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
{
"license": "CC-BY-4.0",
"license_url": "https://creativecommons.org/licenses/by/4.0/",
"source_advisory": "RHSA-2026:97299"
}