CVE-2026-10649
Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression
CVSS Score
8.6
EPSS Score
0.4%
EPSS Percentile
36th
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.
| CWE | CWE-190 |
| Vendor | red hat |
| Product | red hat enterprise linux 10 |
| Published | Jun 16, 2026 |
| Last Updated | Jul 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat enterprise linux 10
Be the first to know when new high vulnerabilities affecting red hat red hat enterprise linux 10 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High
Affected Versions
Red Hat / Red Hat Enterprise Linux 10
All versions affected Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 8
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
All versions affected Red Hat / Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
All versions affected Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 6
All versions affected Red Hat / Red Hat Enterprise Linux 7
All versions affected Red Hat / Red Hat OpenShift Container Platform 4
All versions affected References
access.redhat.com: https://access.redhat.com/errata/RHSA-2026:39322 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:39323 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40833 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41041 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41042 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41043 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41044 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-10649 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2462817 github.com: https://github.com/clusterLabs/pacemaker/pull/4128 openwall.com: http://www.openwall.com/lists/oss-security/2026/06/16/6 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10649.json
Credits
This issue was discovered by AISLE Research and Found by AISLE in partnership with Red Hat.