CVE-2026-10649
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A flaw was found in Pacemaker where an unauthenticated remote attacker can exploit an integer overflow in the remote message decompression process. By sending a specially crafted compressed message before authentication, an attacker can cause memory corruption, leading to denial of service (DoS) in the CIB remote listener.
Risk Assessment
The risk is the potential remote crash of the Pacemaker service, which could disrupt cluster operations and availability of critical applications.
Recommendation
Upgrade Pacemaker to a patched version and restrict access to the CIB remote listener to trusted networks only.
Other vulnerabilities in Pacemaker
See all- CVE-2016-7797High
Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.
- CVE-2015-1867High
Pacemaker before version 1.1.13 does not properly evaluate added nodes, allowing remote read-only users to gain privileges via an acl command.
Original NVD description (English source)
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.