Critical Security Update for fence-agents Packages: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:1240: Important: fence-agents security update. Affects fence-agents-aliyun versions < 4.2.1-129.el8_10.20. Fixed in 4.2.1-129.el8_10.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The fence-agents packages are essential for managing remote power operations for cluster devices. They enable the forced restart and removal of failed or unreachable nodes from a cluster, ensuring system reliability and uptime. However, these packages have been found vulnerable to several security issues that could lead to resource exhaustion and potential denial of service.
Vulnerability Detail
The vulnerabilities stem from issues within the urllib3 library used by the fence-agents packages. Specifically, an unbounded decompression chain can lead to resource exhaustion (CVE-2025-66418), while the streaming API improperly handles highly compressed data (CVE-2025-66471). Additionally, there is a vulnerability that allows a decompression-bomb safeguard bypass when following HTTP redirects (CVE-2026-21441). These vulnerabilities could allow an attacker to exploit the system, leading to service disruptions and potential data loss.
How To Fix
Minimum fixed version
4.2.1-129.el8_10.20
This is the first release that contains the fix.
sudo dnf update fence-agents-aliyunTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the input size for compressed data or disable the streaming API until the packages are updated. However, this is not a permanent solution and updating the packages is strongly recommended.
Conclusion
The fence-agents packages have critical vulnerabilities that need immediate attention. Updating to the latest patched version is essential to maintain system security and reliability. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for fence-agents-aliyun →
FAQ
Fence-agents are scripts used for remote power management of cluster devices, allowing for the forced restart and removal of failed nodes.
The vulnerabilities include an unbounded decompression chain, improper handling of compressed data, and a safeguard bypass when following HTTP redirects.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without any signup.
It is recommended to update the affected fence-agents packages to the patched version 4.2.1-129.el8_10.20 as soon as possible.
Vulert is a service that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for fence-agents-aliyun.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
