Critical Security Flaw in pcs Package: Denial of Service and HTTP Request Smuggling
Summary
RLSA-2026:84798: Important: pcs security update. Affects pcs versions < 0:0.10.18-2.el8_10.10. Fixed in 0:0.10.18-2.el8_10.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs package serves as a command-line configuration tool for the Pacemaker and Corosync utilities, which are essential for managing high-availability clusters. It enables users to configure and control cluster resources effectively. However, vulnerabilities in the underlying libraries can expose systems to significant security risks, including denial of service and HTTP request smuggling attacks.
Vulnerability Detail
The pcs package is affected by two critical vulnerabilities stemming from the python-tornado library. The first vulnerability (CVE-2026-82397) allows for a denial of service through excessive URL-encoded body fields, potentially overwhelming the server. The second vulnerability (CVE-2024-14029) involves HTTP request smuggling via Transfer-Encoding, which can lead to unauthorized access or manipulation of requests. Both vulnerabilities can severely impact the availability and integrity of applications relying on pcs.
How To Fix
Minimum fixed version
0:0.10.18-2.el8_10.10
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing rate limiting on your server to mitigate the impact of potential denial of service attacks. Additionally, review your application’s handling of HTTP headers to prevent request smuggling.
Conclusion
The pcs package has critical vulnerabilities that can lead to denial of service and HTTP request smuggling. It is crucial to update to the latest patched version to protect your systems. Additionally, consider implementing workarounds until the update can be performed.
See every vulnerability recorded for pcs →
FAQ
The vulnerabilities have a CVSS score of 7.5, indicating a high severity level that requires immediate attention.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerabilities can lead to denial of service, unauthorized access, and manipulation of requests, compromising the security and availability of your systems.
Yes, a patched version of the pcs package is available. Update to version 0:0.10.18-2.el8_10.10 or later to mitigate the vulnerabilities.
If immediate updates are not possible, implement rate limiting and review HTTP header handling as temporary workarounds.
References
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
