CVE-2026-10649

EUVD-2026-37128
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.6 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 44.96%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Enterprise Linux 10
0:3.0.1-5.el10_2.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support
0:3.0.0-5.3.el10_0 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support
0:1.1.23-1.el7_9.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
0:2.1.7-5.6.el8_10 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
0:2.0.5-9.el8_4.12 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
0:2.0.5-9.el8_4.12 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
0:2.1.2-4.el8_6.11 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
0:2.1.2-4.el8_6.11 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service
0:2.1.5-9.7.el8_8 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions
0:2.1.5-9.7.el8_8 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
0:2.1.10-3.el9_8 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions
0:2.1.5-9.el9_2.7 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions
0:2.1.7-5.5.el9_4 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support
0:2.1.9-1.4.el9_6 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
pacemaker
bookworm
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pacemaker
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
xenial
needs-triage
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
pacemaker
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-cli
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-cluster-libs
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.6 AUS
0:2.1.2-4.el8_6.11
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-cts
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-doc
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-libs
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.6 AUS
0:2.1.2-4.el8_6.11
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-libs-devel
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-nagios-plugins-metadata
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-remote
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-schemas
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.6 AUS
0:2.1.2-4.el8_6.11
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
python3-pacemaker
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:39322
https://access.redhat.com/errata/RHSA-2026:39323
https://access.redhat.com/errata/RHSA-2026:40833
https://access.redhat.com/errata/RHSA-2026:41041
https://access.redhat.com/errata/RHSA-2026:41042
https://access.redhat.com/errata/RHSA-2026:41043
https://access.redhat.com/errata/RHSA-2026:41044
https://access.redhat.com/errata/RHSA-2026:42041
https://access.redhat.com/errata/RHSA-2026:42075
https://access.redhat.com/errata/RHSA-2026:42076
https://access.redhat.com/errata/RHSA-2026:43606
https://access.redhat.com/security/cve/CVE-2026-10649
https://bugzilla.redhat.com/show_bug.cgi?id=2462817
https://github.com/clusterLabs/pacemaker/pull/4128
http://www.openwall.com/lists/oss-security/2026/06/16/6
https://access.redhat.com/errata/RHSA-2026:39322
https://access.redhat.com/errata/RHSA-2026:39323
https://access.redhat.com/errata/RHSA-2026:40833
https://access.redhat.com/errata/RHSA-2026:41041
https://access.redhat.com/errata/RHSA-2026:41042
https://access.redhat.com/errata/RHSA-2026:41043
https://access.redhat.com/errata/RHSA-2026:41044
https://access.redhat.com/errata/RHSA-2026:42041
https://access.redhat.com/errata/RHSA-2026:42075
https://access.redhat.com/errata/RHSA-2026:42076
https://access.redhat.com/errata/RHSA-2026:43606
https://access.redhat.com/security/cve/CVE-2026-10649
https://bugzilla.redhat.com/show_bug.cgi?id=2462817
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10649.json