CVE-2026-10649— Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 16
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-10649
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Vulnerability Title
ClusterLabs Pacemaker 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ClusterLabs Pacemaker是ClusterLabs组织开源的一款可扩展的高可用性集群资源管理器。 ClusterLabs Pacemaker存在安全漏洞，该漏洞源于远程消息解压缩过程中的整数溢出，可能导致未经身份验证的远程攻击者通过发送特制的压缩远程消息，造成内存损坏，导致CIB远程监听器拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 0:3.0.1-5.el10_2.1 ~ * | cpe:/o:redhat:enterprise_linux:10.2 | |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | 0:3.0.0-5.3.el10_0 ~ * | cpe:/o:redhat:enterprise_linux_eus:10.0 | |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | 0:1.1.23-1.el7_9.2 ~ * | cpe:/o:redhat:enterprise_linux:7::server | |
| Red Hat | Red Hat Enterprise Linux 8 | 0:2.1.7-5.6.el8_10 ~ * | cpe:/a:redhat:enterprise_linux:8::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | 0:2.0.5-9.el8_4.12 ~ * | cpe:/a:redhat:rhel_aus:8.4::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | 0:2.0.5-9.el8_4.12 ~ * | cpe:/a:redhat:rhel_aus:8.4::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | 0:2.1.2-4.el8_6.11 ~ * | cpe:/a:redhat:rhel_aus:8.6::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | 0:2.1.2-4.el8_6.11 ~ * | cpe:/a:redhat:rhel_aus:8.6::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | 0:2.1.5-9.7.el8_8 ~ * | cpe:/a:redhat:rhel_e4s:8.8::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | 0:2.1.5-9.7.el8_8 ~ * | cpe:/a:redhat:rhel_e4s:8.8::appstream | |
| Red Hat | Red Hat Enterprise Linux 9 | 0:2.1.10-3.el9_8 ~ * | cpe:/a:redhat:enterprise_linux:9::appstream | |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | 0:2.1.5-9.el9_2.7 ~ * | cpe:/a:redhat:rhel_e4s:9.2::highavailability | |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | 0:2.1.7-5.5.el9_4 ~ * | cpe:/a:redhat:rhel_e4s:9.4::highavailability | |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | 0:2.1.9-1.4.el9_6 ~ * | cpe:/a:redhat:rhel_eus:9.6::appstream | |
| Red Hat | Red Hat Enterprise Linux 6 | - | cpe:/o:redhat:enterprise_linux:6 | |
| Red Hat | Red Hat OpenShift Container Platform 4 | - | cpe:/a:redhat:openshift:4 |
II. Public POCs for CVE-2026-10649
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 13691 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-10649
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-10649 (1)
Vendor Advisories for CVE-2026-10649 (12)
- 🔗 RHSA-2026:43606 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisoryx_refsource_REDHAT
- 🔗 RHSA-2026:41044 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisoryx_refsource_REDHAT
- 🔗 RHSA-2026:41043 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisoryx_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-06-16 · 8 CVEs total
| CVE-2026-12398 | 7.5 HIGH | Galaxy_ng: shell injection in legacy role import via unsanitized git ref names |
| CVE-2026-42014 | 6.6 MEDIUM | Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin |
| CVE-2026-1767 | 5.6 MEDIUM | Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading |
| CVE-2026-1766 | 5.6 MEDIUM | Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and inform |
| CVE-2026-1765 | 5.6 MEDIUM | Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and potent |
| CVE-2026-1764 | 5.6 MEDIUM | Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leads t |
| CVE-2026-4367 | 5.5 MEDIUM | Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
- CVE-2026-75032
Bluez: bluez: out-of-bounds read in avrcp parse_media_elemen - CVE-2026-13002
Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap - CVE-2026-58224
Samba: ctdb fails to do integrity checking of received packe - CVE-2026-19617
Libdm: lvm2: libdm: denial of service via uncontrolled recur - CVE-2026-73584
Sblim-sfcb: sblim-sfcb: privileged file corruption and denia
Same vendor: Red Hat
- CVE-2026-75924
Managed-serviceaccount: managed-serviceaccount: hub addon-ma - CVE-2026-71365
Awx: webhook status callback ssrf leaks the git pat - CVE-2026-12564
Automation-controller: automation-controller: kubernetes ser - CVE-2026-75485
Must-gather: must-gather: cluster proxy object dumped raw, b - CVE-2026-73834
Must-gather: must-gather: embedded secret data in acm wrappe
Same weakness: CWE-190
- CVE-2026-62357
DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remo - CVE-2026-71479
New API: Integer overflow in quota billing yields negative c - CVE-2026-73193
DBI versions before 1.652 for Perl allow a heap out-of-bound - CVE-2026-18671
IBM i is Affected By Multiple Vulnerabilities in NetServer - CVE-2026-17216
IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM
V. Comments for CVE-2026-10649
No comments yet