Critical Security Update for pcs and pcs-snmp Packages: Denial of Service and HTTP Request Smuggling Vulnerabilities
Summary
ALSA-2026:84798: Important: pcs security update. Affects pcs versions < 0.10.18-2.el8_10.10.alma.1. Fixed in 0.10.18-2.el8_10.10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs (Pacemaker Configuration System) package provides a command-line interface for configuring the Pacemaker and Corosync utilities, which are essential for managing high-availability clusters. The pcs-snmp package extends this functionality by integrating SNMP support, allowing for better monitoring and management of cluster resources. Both packages are crucial for ensuring the reliability and availability of services in enterprise environments. However, they are currently affected by significant security vulnerabilities that could lead to service disruptions.
Vulnerability Detail
The vulnerabilities stem from issues in the python-tornado library used by the pcs packages. The first vulnerability (CVE-2026-82397) allows for a Denial of Service (DoS) attack through excessive URL-encoded body fields, potentially overwhelming the server and causing it to become unresponsive. The second vulnerability (CVE-2024-14029) involves HTTP Request Smuggling due to improper handling of the Transfer-Encoding header, which could allow attackers to manipulate requests and responses, leading to further exploitation of the system.
How To Fix
Minimum fixed version
0.10.18-2.el8_10.10.alma.1
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the size of URL-encoded body fields in your application to mitigate the risk of Denial of Service attacks. Additionally, review and restrict the use of Transfer-Encoding in your HTTP requests to minimize the potential for HTTP request smuggling.
Conclusion
The pcs and pcs-snmp packages are critical for managing high-availability clusters but are currently vulnerable to significant security issues. It is crucial to update to the latest patched versions to protect your systems from potential attacks. Utilize tools like Vulert to monitor and assess your applications for vulnerabilities effectively.
See every vulnerability recorded for pcs →
FAQ
The main vulnerabilities are a Denial of Service attack via excessive URL-encoded body fields and HTTP Request Smuggling due to improper handling of the Transfer-Encoding header.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
These vulnerabilities can lead to service disruptions, allowing attackers to overwhelm the server or manipulate requests, potentially compromising the integrity of the system.
Yes, a patch is available. You should update to version 0.10.18-2.el8_10.10.alma.1 of the pcs and pcs-snmp packages.
If you cannot update immediately, consider implementing temporary workarounds such as limiting URL-encoded body field sizes and reviewing Transfer-Encoding usage.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
