Critical Vulnerability in Resource-Agents Package: Denial of Service Risk
Summary
ALSA-2026:53364: Important: resource-agents security update. Affects resource-agents versions < 4.9.0-54.el8_10.37.alma.1. Fixed in 4.9.0-54.el8_10.37.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The resource-agents package is essential for managing high-availability (HA) environments, providing scripts that interface with various services through Pacemaker and RGManager service managers. This package is crucial for ensuring that services remain operational and can recover from failures. However, it is vulnerable to a Denial of Service (DoS) attack due to issues in the pyasn1 library, which can be exploited through crafted ASN.1 REAL values.
Vulnerability Detail
The vulnerability identified as CVE-2026-59886 allows attackers to exploit the pyasn1 library used within the resource-agents package. By sending specially crafted ASN.1 REAL values, an attacker can cause a Denial of Service, rendering the service unavailable. This vulnerability poses a significant risk to systems relying on high availability, as it can disrupt critical services and lead to downtime.
How To Fix
Minimum fixed version
4.9.0-54.el8_10.37.alma.1
This is the first release that contains the fix.
sudo dnf update resource-agentsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can mitigate the risk by restricting access to the services managed by the resource-agents package or by implementing network-level controls to filter out malicious traffic that could exploit this vulnerability.
Conclusion
The resource-agents package is critical for managing high-availability environments but is currently vulnerable to a Denial of Service attack due to issues in the pyasn1 library. It is essential to update to the patched version to mitigate this risk. Temporary workarounds can be implemented while awaiting updates.
See every vulnerability recorded for resource-agents →
FAQ
The vulnerability allows for a Denial of Service attack through crafted ASN.1 REAL values, potentially disrupting high-availability services.
You can use Vulert to check if your application is affected by this vulnerability by analyzing your manifest file, such as package-lock.json.
Implement network-level controls to restrict access to the affected services as a temporary workaround until the package can be updated.
Detailed information about the CVE-2026-59886 can be found on the official CVE page or through security advisory documentation.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for resource-agents.
