Executive brief
Pacemaker is a high-availability cluster resource manager used to ensure critical services remain online. A vulnerability in how it handles compressed network messages allows an unauthenticated attacker to crash the cluster's remote management service. This can lead to a denial of service, potentially causing cluster nodes to fail or become unresponsive, disrupting business operations.
Technical details
An integer overflow vulnerability exists in Pacemaker's `pcmk__remote_message_xml()` function within `lib/common/remote.c`. The flaw is rooted in the lack of bounds checking for `payload_offset` and `payload_uncompressed` values provided in remote message headers. An attacker can provide crafted values that cause size calculations to wrap during memory allocation, leading to a heap-based buffer overflow when `BZ2_bzBuffToBuffDecompress()` is called. This occurs before authentication in the CIB remote listener (`daemons/based/based_remote.c`). Successful exploitation allows a remote, unauthenticated attacker to crash the service. A patch has been proposed in the upstream repository to validate header sizes and use overflow-safe arithmetic.
Affected products
- ClusterLabs Pacemaker 3.0.1-5.el10 and earlier versions supporting remote message compression
Timeline
- 2026-04-26: other: Initial internal report via OSIDB
- 2026-06-16: disclosed: Public disclosure of CVE-2026-10649
- 2026-06-16: other: Upstream pull request 4128 created to address the issue