CVE-2026-10649

EUVD-2026-37128
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.6 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Enterprise Linux 10
0:3.0.1-5.el10_2.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support
0:3.0.0-5.3.el10_0 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support
0:1.1.23-1.el7_9.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
0:2.1.7-5.6.el8_10 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
0:2.0.5-9.el8_4.12 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
0:2.0.5-9.el8_4.12 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
0:2.1.2-4.el8_6.11 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
0:2.1.2-4.el8_6.11 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service
0:2.1.5-9.7.el8_8 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions
0:2.1.5-9.7.el8_8 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
0:2.1.10-3.el9_8 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions
0:2.1.5-9.el9_2.7 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions
0:2.1.7-5.5.el9_4 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support
0:2.1.9-1.4.el9_6 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
pacemaker
bookworm
vulnerable
bullseye
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
pacemaker
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-cli
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-cluster-libs
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.6 AUS
0:2.1.2-4.el8_6.11
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-cts
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-doc
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-libs
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.6 AUS
0:2.1.2-4.el8_6.11
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-libs-devel
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-nagios-plugins-metadata
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-remote
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
pacemaker-schemas
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 8.4 AUS
0:2.0.5-9.el8_4.12
fixed
RHEL 8.6 AUS
0:2.1.2-4.el8_6.11
fixed
RHEL 8.8 E4S
0:2.1.5-9.7.el8_8
fixed
RHEL 8.8 TUS
0:2.1.5-9.7.el8_8
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
python3-pacemaker
RHEL 8
0:2.1.7-5.6.el8_10
fixed
RHEL 9
0:2.1.10-3.el9_8
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:39322
https://access.redhat.com/errata/RHSA-2026:39323
https://access.redhat.com/errata/RHSA-2026:40833
https://access.redhat.com/errata/RHSA-2026:41041
https://access.redhat.com/errata/RHSA-2026:41042
https://access.redhat.com/errata/RHSA-2026:41043
https://access.redhat.com/errata/RHSA-2026:41044
https://access.redhat.com/errata/RHSA-2026:42041
https://access.redhat.com/errata/RHSA-2026:42075
https://access.redhat.com/errata/RHSA-2026:42076
https://access.redhat.com/errata/RHSA-2026:43606
https://access.redhat.com/security/cve/CVE-2026-10649
https://bugzilla.redhat.com/show_bug.cgi?id=2462817
https://github.com/clusterLabs/pacemaker/pull/4128
http://www.openwall.com/lists/oss-security/2026/06/16/6
https://access.redhat.com/errata/RHSA-2026:39322
https://access.redhat.com/errata/RHSA-2026:39323
https://access.redhat.com/errata/RHSA-2026:40833
https://access.redhat.com/errata/RHSA-2026:41041
https://access.redhat.com/errata/RHSA-2026:41042
https://access.redhat.com/errata/RHSA-2026:41043
https://access.redhat.com/errata/RHSA-2026:41044
https://access.redhat.com/errata/RHSA-2026:42041
https://access.redhat.com/errata/RHSA-2026:42075
https://access.redhat.com/errata/RHSA-2026:42076
https://access.redhat.com/errata/RHSA-2026:43606
https://access.redhat.com/security/cve/CVE-2026-10649
https://bugzilla.redhat.com/show_bug.cgi?id=2462817
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10649.json