Integer Overflow Vulnerability in Pacemaker Affects Remote Message Processing
CVE-2026-10649
8.6HIGH
Key Information:
What is CVE-2026-10649?
A vulnerability exists in Pacemaker that permits unauthenticated remote attackers to exploit an integer overflow in the remote message decompression process. By sending a specially crafted compressed message before authentication, the attacker can trigger memory corruption. This flaw can lead to a denial of service condition within the CIB remote listener, resulting in the service crashing and potentially impairing operations.
Affected Version(s)
Red Hat Enterprise Linux 10 0:3.0.1-5.el10_2.1
Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.0.0-5.3.el10_0
Red Hat Enterprise Linux 8 0:2.1.7-5.6.el8_10
References
CVSS V3.1
Score:
8.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
This issue was discovered by Found by AISLE in partnership with Red Hat.