Critical Denial of Service Vulnerability in Pacemaker Package
Summary
ALSA-2026:40833: Important: pacemaker security update. Affects pacemaker versions < 3.0.1-5.el10_2.1. Fixed in 3.0.1-5.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pacemaker is a cluster resource manager that ensures data integrity and application availability during failures. It is widely used in high-availability environments to manage resources and services across multiple nodes. The package includes various components such as pacemaker-cli, pacemaker-cluster-libs, and pacemaker-remote, which work together to maintain system stability and performance. However, a recently discovered vulnerability poses a significant risk to its functionality.
Vulnerability Detail
The vulnerability identified as CVE-2026-10649 is an integer overflow issue that can lead to a Denial of Service (DoS) when remote messages are decompressed. This flaw allows an attacker to exploit the system by sending specially crafted messages, potentially causing the Pacemaker service to crash or become unresponsive. The impact of this vulnerability is critical, as it can disrupt the availability of services managed by Pacemaker, leading to significant downtime and loss of data integrity.
How To Fix
Minimum fixed version
3.0.1-5.el10_2.1
This is the first release that contains the fix.
sudo dnf update pacemakerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable remote message handling in Pacemaker to mitigate the risk of exploitation until the package is updated. This can be done by modifying the configuration settings in the Pacemaker configuration file, but it is recommended to apply the patch as soon as possible for full protection.
Conclusion
The discovery of CVE-2026-10649 in the Pacemaker package highlights a critical vulnerability that can lead to Denial of Service attacks. It is crucial for users to update their packages to the patched version to ensure the security and availability of their systems. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for pacemaker →
FAQ
CVE-2026-10649 is a critical vulnerability in the Pacemaker package that can lead to a Denial of Service due to an integer overflow during remote message decompression.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can cause the Pacemaker service to crash or become unresponsive, leading to service downtime and potential data loss.
You can update the Pacemaker package by running the command 'sudo dnf update pacemaker pacemaker-cli pacemaker-cluster-libs pacemaker-cts pacemaker-doc pacemaker-libs pacemaker-libs-devel pacemaker-remote pacemaker-schemas python3-pacemaker' in your terminal.
Yes, you can temporarily disable remote message handling in the Pacemaker configuration to mitigate the risk until the package is updated.
Related vulnerabilities
Recent vulnerabilities recorded for pacemaker.
