Moderate Security Vulnerability in pcs and pcs-snmp Packages: Denial of Service Risk
Summary
ALSA-2026:8093: Moderate: pcs security update. Affects pcs versions < 0.10.18-2.el8_10.9.alma.1. Fixed in 0.10.18-2.el8_10.9.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs (Pacemaker Configuration System) and pcs-snmp packages are essential tools in the AlmaLinux ecosystem, providing a command-line interface for configuring and managing the Pacemaker and Corosync utilities. These packages facilitate high availability clustering, ensuring that services remain operational even in the event of hardware or software failures. However, they are susceptible to a security flaw that can lead to denial of service, particularly when handling large multipart bodies.
Vulnerability Detail
The vulnerability identified as CVE-2026-31958 affects the Tornado web framework used within the pcs packages. It allows an attacker to exploit the system by sending large multipart bodies, which can overwhelm the server and lead to a denial of service. This could result in service interruptions, making the system unresponsive to legitimate requests. The issue arises from inadequate handling of large input data, which can exhaust server resources.
How To Fix
Minimum fixed version
0.10.18-2.el8_10.9.alma.1
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the size of multipart requests handled by the server. This can be done by configuring the Tornado settings to reject requests that exceed a certain size. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The pcs and pcs-snmp packages are critical for managing high availability in AlmaLinux systems. The identified vulnerability poses a significant risk of denial of service, but it can be effectively mitigated by updating to the latest patched version. Users are encouraged to take immediate action to secure their systems.
See every vulnerability recorded for pcs →
FAQ
The vulnerability is a denial of service risk caused by the handling of large multipart bodies in the Tornado web framework.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to service interruptions, making the system unresponsive and affecting the availability of critical services.
Yes, a patch is available in version 0.10.18-2.el8_10.9.alma.1 for both pcs and pcs-snmp packages.
As a temporary workaround, you can limit the size of multipart requests in your server configuration to mitigate the risk until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
