CVE-2026-10649 | BDVDB-2026-340677 Detail
Red HatRed Hat Enterprise Linux 10
Description#
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact high. Attack vector: network.
Weaknesses#
- CWE-190 Integer Overflow or Wraparound
References#
- https://access.redhat.com/errata/RHSA-2026:39322
- https://access.redhat.com/errata/RHSA-2026:39323
- https://access.redhat.com/errata/RHSA-2026:40833
- https://access.redhat.com/errata/RHSA-2026:41041
- https://access.redhat.com/errata/RHSA-2026:41042
- https://access.redhat.com/errata/RHSA-2026:41043
- https://access.redhat.com/errata/RHSA-2026:41044
- https://access.redhat.com/errata/RHSA-2026:42041
- https://access.redhat.com/errata/RHSA-2026:42075
- https://access.redhat.com/errata/RHSA-2026:42076
- https://access.redhat.com/errata/RHSA-2026:43606
- https://access.redhat.com/security/cve/CVE-2026-10649
- https://bugzilla.redhat.com/show_bug.cgi?id=2462817
- https://github.com/clusterLabs/pacemaker/pull/4128
- http://www.openwall.com/lists/oss-security/2026/06/16/6
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.