A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pacemaker-remoteUpgrade pacemaker-cluster-libsUpgrade pacemaker-libsUpgrade pacemaker-nagios-plugins-metadataUpgrade pacemaker-schemasUpgrade pacemakerUpgrade python3-pacemakerUpgrade pacemaker-libs-develUpgrade pacemaker-ctsUpgrade pacemaker-docUpgrade pacemaker-cli | Jul 15, 2026 | Jul 14, 2026 |
| Redhat_linux | — | Upgrade pacemaker-debugsourceUpgrade pacemaker-cliUpgrade pacemaker-remote-debuginfoUpgrade pacemaker-ctsUpgrade pacemaker-debuginfoUpgrade python3-pacemakerUpgrade pacemakerUpgrade pacemaker-nagios-plugins-metadataUpgrade pacemaker-docUpgrade pacemaker-libs-debuginfoUpgrade pacemaker-cluster-libsUpgrade pacemaker-cli-debuginfoUpgrade pacemaker-libs-develUpgrade pacemaker-remoteUpgrade pacemaker-cluster-libs-debuginfoUpgrade pacemaker-libsUpgrade pacemaker-schemas | Jul 16, 2026 | Jun 16, 2026 |
| Rocky_linux | — | Upgrade pacemaker-libsUpgrade pacemaker-libs-develUpgrade pacemaker-cliUpgrade pacemaker-cluster-libs-debuginfoUpgrade pacemaker-remoteUpgrade pacemaker-debugsourceUpgrade pacemaker-libs-debuginfoUpgrade pacemakerUpgrade pacemaker-remote-debuginfoUpgrade pacemaker-debuginfoUpgrade pacemaker-cli-debuginfoUpgrade pacemaker-cluster-libs | Jul 17, 2026 | Jul 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub