Critical Security Update for Pacemaker: Denial of Service Vulnerability
Summary
ALSA-2026:39322: Important: pacemaker security update. Affects pacemaker versions < 2.1.7-5.6.el8_10. Fixed in 2.1.7-5.6.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pacemaker is a cluster resource manager that ensures data integrity and application availability during failures. It is widely used in high-availability environments to manage resources and services across multiple nodes. The package is crucial for maintaining system uptime and reliability, making it a key component in enterprise-level applications. However, it has recently been identified as vulnerable to a Denial of Service (DoS) attack due to an integer overflow in remote message decompression.
Vulnerability Detail
The vulnerability identified as CVE-2026-10649 allows an attacker to exploit an integer overflow in the remote message decompression process of Pacemaker. This can lead to a Denial of Service condition, where legitimate users are unable to access the services managed by Pacemaker. The issue arises from improper handling of input data, which can be manipulated to cause the application to crash or become unresponsive. This vulnerability poses a significant risk to systems relying on Pacemaker for high availability, as it can lead to prolonged outages and service disruptions.
How To Fix
Minimum fixed version
2.1.7-5.6.el8_10
This is the first release that contains the fix.
sudo dnf update pacemakerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing network-level protections such as firewalls to restrict access to the Pacemaker service. Additionally, monitor logs for unusual activity that may indicate an attempted exploit.
Conclusion
The identified vulnerability in Pacemaker (CVE-2026-10649) poses a serious risk of Denial of Service attacks, affecting the availability of critical services. It is crucial to update to the patched version to ensure system integrity and reliability. For those unable to update immediately, implementing workarounds can help mitigate risks until a full update can be performed.
See every vulnerability recorded for pacemaker →
FAQ
CVE-2026-10649 is a vulnerability in the Pacemaker cluster resource manager that allows for a Denial of Service attack due to an integer overflow in remote message decompression.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
Exploiting this vulnerability can lead to a Denial of Service condition, making services managed by Pacemaker unavailable to legitimate users, which can result in significant downtime.
Yes, a patch is available in version 2.1.7-5.6.el8_10 and it is recommended to update to this version to mitigate the vulnerability.
If you cannot update immediately, consider implementing network-level protections and monitoring for unusual activity as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for pacemaker.
