Critical Security Update for fence-agents Packages: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:1239: Important: fence-agents security update. Affects fence-agents-aliyun versions < 4.10.0-98.el9_7.4. Fixed in 4.10.0-98.el9_7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fence-agents packages are essential for managing remote power operations for cluster devices, enabling the forced restart and removal of failed or unreachable nodes from the cluster. These packages are crucial for maintaining the reliability and availability of clustered environments, particularly in enterprise settings. However, recent vulnerabilities have been identified that could compromise the security and stability of these operations.
Vulnerability Detail
The vulnerabilities stem from issues within the urllib3 library, which is utilized by the fence-agents packages. Specifically, the vulnerabilities include an unbounded decompression chain leading to resource exhaustion (CVE-2025-66418), improper handling of highly compressed data (CVE-2025-66471), and a safeguard bypass for decompression bombs when following HTTP redirects (CVE-2026-21441). These vulnerabilities could allow an attacker to exploit the system, potentially leading to denial of service or unauthorized access to sensitive data.
How To Fix
Minimum fixed version
4.10.0-98.el9_7.4
This is the first release that contains the fix.
sudo dnf update fence-agents-aliyunTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict the use of the vulnerable urllib3 library in their applications or limit the input size for decompression operations until the package is updated.
Conclusion
The identified vulnerabilities in the fence-agents packages pose significant risks to the security and stability of clustered environments. Immediate action is required to update the affected packages to mitigate these risks and ensure the continued reliability of remote power management operations.
See every vulnerability recorded for fence-agents-aliyun →
FAQ
The vulnerabilities include an unbounded decompression chain, improper handling of compressed data, and a safeguard bypass for decompression bombs.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
It is recommended to update the affected fence-agents packages to version 4.10.0-98.el9_7.4 as soon as possible.
Failure to address these vulnerabilities could lead to denial of service attacks or unauthorized access to sensitive data within your cluster.
More information can be found on the CVE pages linked in the advisory or by visiting the official documentation for the fence-agents packages.
Related vulnerabilities
Recent vulnerabilities recorded for fence-agents-aliyun.
