Critical Security Update for fence-agents Packages: Addressing Denial of Service Vulnerability
Summary
ALSA-2026:47736: Important: fence-agents security update. Affects fence-agents-aliyun versions < 4.2.1-129.el8_10.27. Fixed in 4.2.1-129.el8_10.27. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fence-agents packages are essential tools for managing remote power operations in cluster environments. They enable administrators to forcibly restart and remove failed or unreachable nodes from the cluster, ensuring high availability and reliability of services. However, these packages have been found to be vulnerable to a Denial of Service (DoS) attack, which could compromise the stability of the cluster.
Vulnerability Detail
The vulnerability, identified as CVE-2026-59939, arises from an unbounded decompression of HTTP response bodies in the httplib2 library used by the fence-agents. This flaw allows an attacker to send specially crafted HTTP responses that, when decompressed, could consume excessive system resources, leading to a denial of service. The potential ramifications include service outages and degraded performance of the cluster, which could impact critical operations.
How To Fix
Minimum fixed version
4.2.1-129.el8_10.27
This is the first release that contains the fix.
sudo dnf update fence-agents-aliyunTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the size of HTTP response bodies processed by the fence-agents to mitigate the risk of a DoS attack. This can be done by configuring the HTTP client settings to impose size limits on incoming responses.
Conclusion
In summary, the fence-agents packages are critical for managing cluster power operations but are vulnerable to a Denial of Service attack due to an issue in the httplib2 library. It is essential to update to the patched version to mitigate this risk and ensure the stability of your cluster.
See every vulnerability recorded for fence-agents-aliyun →
FAQ
CVE-2026-59939 is a vulnerability in the httplib2 library used by fence-agents that allows for Denial of Service attacks through unbounded decompression of HTTP response bodies.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to service outages and degraded performance of the cluster, affecting critical operations and availability.
You can update the affected fence-agents packages to the fixed version 4.2.1-129.el8_10.27 using the command provided in the 'how_to_fix' section.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for fence-agents-aliyun.
