Back Linuxsecurity

SUSE Pacemaker Important DoS Denial of Service Vuln 2026-2719

Linuxsecurity •LinuxSecurity Advisories • July 1, 2026

## This update for pacemaker fixes the following issues: * CVE-2026-10649: Fixed denial-of-service via integer overflow in remote message decompression (bsc#1268381). Changes for pacemaker: * Update to version 2.1.10+20260618.4bca25e3c1: * libcrmcommon: Add additional checks to pcmk__remote_message_xml. (Crh#2462817, gh#ClusterLabs/pacemaker#4133) * libcib: Remove an unnecessary coverity suppression. (Crh#2462817, gh#ClusterLabs/pacemaker#4133) * libcrmcommon: Fix an integer overflow in pcmk__remote_send_xml. (Crh#2462817, gh#ClusterLabs/pacemaker#4133) * libcrmcommon: Limit the max size of a remote message. (Crh#2462817, gh#ClusterLabs/pacemaker#4133) * libcrmcommon: Fix integer overflow in remote message code. (Crh#2462817, gh#ClusterLabs/pacemaker#4133)

* CVE-2026-10649 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-10649 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

* SUSE Linux Enterprise High Availability Extension 15 SP7

* SUSE Linux Enterprise Server 15 SP7

* SUSE Linux Enterprise Server for SAP Applications 15 SP7

An update that solves one vulnerability can now be installed.

Announcement ID: SUSE-SU-2026:2719-1 Release Date: 2026-07-01T11:33:19Z Rating: important

Get the latest Linux and open source security news straight to your inbox.