Critical Security Update for Pacemaker: Denial of Service Vulnerability
Summary
ALSA-2026:39323: Important: pacemaker security update. Affects pacemaker versions < 2.1.10-3.el9_8. Fixed in 2.1.10-3.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pacemaker is a cluster resource manager that ensures data integrity and application availability during failures. It is widely used in high-availability environments to manage resources and services across multiple nodes. The package is essential for maintaining operational continuity and is designed to handle various cluster configurations. However, it is vulnerable to a specific Denial of Service (DoS) attack due to an integer overflow in remote message decompression, which can compromise its reliability.
Vulnerability Detail
The vulnerability identified as CVE-2026-10649 allows an attacker to exploit an integer overflow during the decompression of remote messages in Pacemaker. This can lead to a Denial of Service condition, where legitimate users are unable to access the services managed by Pacemaker. The issue arises from improper handling of input data, which can be manipulated to trigger the overflow, resulting in application crashes or unresponsive states. The ramifications of this vulnerability can be severe, especially in production environments where uptime is critical.
How To Fix
Minimum fixed version
2.1.10-3.el9_8
This is the first release that contains the fix.
sudo dnf update pacemakerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit access to the Pacemaker service from untrusted networks or implement network-level controls to mitigate the risk of exploitation until the package is updated.
Conclusion
The Pacemaker security update addresses a critical vulnerability that could lead to Denial of Service conditions. It is essential for users to update their packages to the patched version to ensure continued service availability and integrity. Implementing the recommended fixes and workarounds will help mitigate the risks associated with this vulnerability.
See every vulnerability recorded for pacemaker →
FAQ
The impact includes potential Denial of Service conditions, where the Pacemaker service may become unresponsive, affecting application availability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, consider implementing network restrictions to limit access to the Pacemaker service.
While the vulnerability primarily affects availability, it does not directly cause data loss. However, prolonged downtime could lead to operational issues.
For more details, refer to the CVE page for CVE-2026-10649, which provides comprehensive information about the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for pacemaker.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
