Critical Denial of Service Vulnerability in Resource Agents Packages
Summary
ALSA-2026:1904: Important: resource-agents security update. Affects resource-agents versions < 4.9.0-54.el8_10.28. Fixed in 4.9.0-54.el8_10.28. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The resource-agents packages are essential components that provide scripts for the Pacemaker and RGManager service managers, enabling high-availability (HA) environments. These packages interface with various services to ensure reliability and uptime. However, they are susceptible to vulnerabilities that can compromise their functionality and security.
Vulnerability Detail
The vulnerability identified as CVE-2026-23490 is a Denial of Service (DoS) issue caused by memory exhaustion resulting from malformed RELATIVE-OID inputs. This vulnerability can lead to service disruptions, making the system unresponsive and affecting the availability of critical services managed by the resource-agents packages. Attackers can exploit this flaw to overload the system's memory, leading to potential downtime and loss of service.
How To Fix
Minimum fixed version
4.9.0-54.el8_10.28
This is the first release that contains the fix.
sudo dnf update resource-agentsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the exposure of the affected services to untrusted inputs or implement network-level controls to restrict access until the packages can be updated.
Conclusion
The resource-agents packages are critical for maintaining high-availability environments, but they are currently vulnerable to a Denial of Service attack due to CVE-2026-23490. It is crucial to update to the patched version to ensure system stability and security. Implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for resource-agents →
FAQ
CVE-2026-23490 is a Denial of Service vulnerability in the resource-agents packages that can cause memory exhaustion from malformed RELATIVE-OID inputs.
This vulnerability can lead to service disruptions, making your system unresponsive and affecting the availability of critical services.
The affected packages include resource-agents, resource-agents-aliyun, resource-agents-gcp, and resource-agents-paf.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If immediate updates are not possible, consider implementing network-level controls to restrict access to the affected services until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for resource-agents.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
