Critical Security Update for pcs and pcs-snmp Packages: Addressing Multiple Rack Vulnerabilities
Summary
ALSA-2025:20962: Important: pcs security update. Affects pcs versions < 0.11.10-1.el9_7.1. Fixed in 0.11.10-1.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs (Pacemaker Configuration System) and pcs-snmp packages are essential tools for managing high-availability clusters using Pacemaker and Corosync utilities. These packages provide a command-line interface for configuration, monitoring, and management of cluster resources. However, recent vulnerabilities have been identified in the underlying Rack library, which can lead to significant security risks, including denial of service (DoS) attacks and memory exhaustion.
Vulnerability Detail
The vulnerabilities stem from the Rack library used within the pcs and pcs-snmp packages. Specifically, issues such as unsafe default parameters in Rack's QueryParser (CVE-2025-59830) and unbounded multipart preamble buffering (CVE-2025-61770) can allow attackers to exploit these weaknesses, leading to memory exhaustion and potential service disruptions. The vulnerabilities can be triggered by sending specially crafted requests that overwhelm the server's memory resources, resulting in denial of service.
How To Fix
Minimum fixed version
0.11.10-1.el9_7.1
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider limiting the number of parameters that can be processed by the Rack QueryParser. This can help reduce the risk of exploitation until the packages are updated. However, the best course of action is to apply the security update as soon as possible.
Conclusion
The pcs and pcs-snmp packages have critical vulnerabilities related to the Rack library that can lead to denial of service and memory exhaustion. It is essential to update to the latest patched version to ensure the security and stability of your applications. Utilizing tools like Vulert can further enhance your ability to monitor and respond to vulnerabilities in real-time.
See every vulnerability recorded for pcs →
FAQ
The main vulnerabilities are related to the Rack library, including unsafe default parameters and unbounded memory usage, which can lead to denial of service.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can receive real-time alerts about vulnerabilities.
It is recommended to update both packages to version 0.11.10-1.el9_7.1 to mitigate the vulnerabilities.
While specific exploits may not be publicly disclosed, the vulnerabilities can be exploited to cause denial of service through memory exhaustion.
Vulert is a tool that monitors open-source vulnerabilities in your software using a manifest file. It provides real-time alerts and can help you identify if your application is affected by known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
