Moderate pcs Security Update: Addressing Tornado DoS Vulnerabilities
Summary
ALSA-2026:0930: Moderate: pcs security update. Affects pcs versions < 0.10.18-2.el8_10.8.alma.1. Fixed in 0.10.18-2.el8_10.8.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs package is a command-line configuration tool designed for managing the Pacemaker and Corosync utilities, which are essential for high-availability clustering in Linux environments. This package allows administrators to configure and manage cluster resources effectively. However, recent vulnerabilities have been identified that could compromise the stability and security of systems utilizing pcs.
Vulnerability Detail
The pcs package has been found to be vulnerable to two specific denial-of-service (DoS) attacks related to the Tornado web framework. The first vulnerability (CVE-2025-67725) allows for a quadratic DoS via repeated header coalescing, while the second vulnerability (CVE-2025-67726) involves crafted multipart parameters. These vulnerabilities can lead to significant resource exhaustion, potentially causing service outages and impacting system availability.
How To Fix
Minimum fixed version
0.10.18-2.el8_10.8.alma.1
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the exposure of the pcs service to trusted networks only, and monitor for unusual traffic patterns that may indicate an ongoing attack. Additionally, implementing rate limiting on incoming requests may help mitigate the impact of these vulnerabilities until a patch can be applied.
Conclusion
The pcs package has been identified with moderate vulnerabilities that could lead to denial-of-service attacks. It is crucial for users to update to the latest patched version to ensure the security and stability of their systems. Utilizing tools like Vulert can further enhance vulnerability management and monitoring.
See every vulnerability recorded for pcs →
FAQ
The pcs package is vulnerable to two DoS attacks via the Tornado framework, which can exhaust system resources and lead to service outages.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
It is recommended to update the pcs and pcs-snmp packages to the patched version 0.10.18-2.el8_10.8.alma.1 to mitigate the vulnerabilities.
While specific exploits have not been publicly disclosed, the nature of the vulnerabilities suggests that they could be exploited to cause service disruptions.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights into potential security risks.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.