Critical Security Update for Resource Agents: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:1241: Important: resource-agents security update. Affects resource-agents versions < 4.9.0-54.el8_10.27. Fixed in 4.9.0-54.el8_10.27. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The resource-agents package is essential for managing high-availability (HA) environments, providing scripts that interface with service managers like Pacemaker and RGManager. These scripts ensure that services remain operational and can recover from failures. However, vulnerabilities in this package can lead to severe resource exhaustion and potential service disruptions.
Vulnerability Detail
The vulnerabilities stem from issues in the urllib3 library, which is used within the resource-agents package. Specifically, the vulnerabilities include an unbounded decompression chain leading to resource exhaustion (CVE-2025-66418), improper handling of highly compressed data (CVE-2025-66471), and a bypass of decompression-bomb safeguards when following HTTP redirects (CVE-2026-21441). These vulnerabilities can allow attackers to exploit the system, leading to denial of service or resource depletion.
How To Fix
Minimum fixed version
4.9.0-54.el8_10.27
This is the first release that contains the fix.
sudo dnf update resource-agentsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the input size for compressed data or disabling the streaming API if feasible. This can help mitigate the risk until the package is updated.
Conclusion
The vulnerabilities in the resource-agents package pose significant risks to high-availability environments. It is crucial to update to the latest patched version to mitigate these risks. Users should also consider temporary workarounds while planning for an update.
See every vulnerability recorded for resource-agents →
FAQ
The main vulnerabilities include resource exhaustion due to unbounded decompression, improper handling of compressed data, and bypassing safeguards against decompression bombs.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
These vulnerabilities can lead to denial of service, resource depletion, and potential service disruptions in high-availability environments.
Yes, a patch is available in version 4.9.0-54.el8_10.27 of the resource-agents package.
If an immediate update is not possible, consider implementing input size limits for compressed data or disabling the streaming API as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for resource-agents.
