CVE-2026-10649 Overview
CVE-2026-10649 is an integer overflow vulnerability [CWE-190] in Pacemaker, the high-availability cluster resource manager used across Linux distributions. The flaw resides in the remote message decompression routine handling compressed traffic received by the Cluster Information Base (CIB) remote listener. An unauthenticated remote attacker can send a specially crafted compressed message before authentication completes, triggering memory corruption that crashes the affected service.
The vulnerability impacts the availability of clustered services that rely on Pacemaker for failover and resource orchestration. Red Hat issued advisory tracking under bug 2462817, and a fix landed in the ClusterLabs Pacemaker repository through pull request 4128.
Critical Impact
Unauthenticated network attackers can crash the Pacemaker CIB remote listener, causing denial of service against high-availability cluster infrastructure.
Affected Products
- Pacemaker (ClusterLabs) — versions prior to the fix in pull request 4128
- Red Hat Enterprise Linux distributions shipping Pacemaker (see vendor advisory)
- Downstream Linux distributions packaging Pacemaker with the vulnerable remote listener
Discovery Timeline
- 2026-06-16 - CVE-2026-10649 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-10649
Vulnerability Analysis
The vulnerability stems from improper handling of size fields during decompression of remote cluster messages. Pacemaker's CIB remote listener accepts compressed payloads from peer nodes over the network. During decompression, the code performs arithmetic on attacker-controlled length values without bounds enforcement.
The arithmetic operation overflows an integer, producing a smaller allocation than required. Subsequent decompression writes data beyond the allocated buffer, corrupting adjacent heap memory. The corruption causes the listener process to crash, terminating cluster communication.
Because the decompression path executes before authentication, no credentials are required to reach the vulnerable code. The attack requires only network reachability to the CIB remote listener port.
Root Cause
The root cause is a classic integer overflow [CWE-190] in size calculations during remote message decompression. The code trusts length metadata from the compressed message header and uses it in arithmetic that produces an undersized buffer. When decompressed data exceeds the truncated size, heap memory corruption occurs.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker establishes a connection to the Pacemaker CIB remote listener and transmits a crafted compressed payload with malicious length fields. The listener processes the message during the pre-authentication decompression stage, triggering the overflow.
The immediate impact is denial of service through process crash. The advisory describes memory corruption, which in principle could be leveraged for further exploitation, though available analysis reports the practical outcome as service crash.
For technical implementation details, refer to the GitHub Pacemaker Pull Request and the Red Hat CVE-2026-10649 Advisory.
Detection Methods for CVE-2026-10649
Indicators of Compromise
- Unexpected termination or repeated crashes of the pacemaker-based or pacemaker-remoted process on cluster nodes
- Core dumps generated by Pacemaker components referencing decompression routines such as those handling bzlib or bz2 operations
- Cluster failover events triggered without corresponding hardware or workload changes
- Inbound connections to the CIB remote listener port from unexpected source addresses prior to crash events
Detection Strategies
- Monitor systemd journal and /var/log/pacemaker/pacemaker.log for abnormal exit codes and signal terminations of Pacemaker daemons
- Deploy network detection rules that identify malformed compressed payloads arriving at the CIB remote listener port
- Correlate sudden cluster quorum loss events with network traffic from external sources to identify potential exploitation attempts
Monitoring Recommendations
- Enable verbose logging on Pacemaker components and forward logs to a centralized SIEM for crash pattern analysis
- Track process uptime and restart counts for pacemaker-based, pacemaker-controld, and pacemaker-remoted
- Audit firewall logs for unauthorized connection attempts to TCP port 3121 (Pacemaker Remote) and CIB ports
How to Mitigate CVE-2026-10649
Immediate Actions Required
- Apply vendor-supplied Pacemaker updates as soon as they become available from your Linux distribution
- Restrict network access to Pacemaker remote listener ports using host firewalls and network ACLs, limiting connections to known cluster member addresses
- Audit cluster node exposure and remove any internet-facing access to Pacemaker services
- Review cluster logs for prior crash events that may indicate exploitation attempts
Patch Information
The upstream fix is tracked in GitHub Pacemaker Pull Request #4128. Red Hat customers should monitor the Red Hat CVE-2026-10649 Advisory and Red Hat Bug Report #2462817 for distribution-specific package releases. Apply vendor patches through standard package management once published for your platform.
Workarounds
- Disable the Pacemaker remote listener if remote node functionality is not required in your cluster deployment
- Place strict iptables or nftables rules restricting access to TCP port 3121 to only authorized cluster peer IP addresses
- Deploy Pacemaker traffic over isolated management VLANs or IPsec tunnels to prevent untrusted network exposure
- Consult the Openwall OSS-Security Discussion for community-reported mitigation guidance
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
