CVE-2026-16530: PCP pmproxy Service DoS Vulnerability

CVE-2026-16530 Overview

CVE-2026-16530 is an out-of-bounds read vulnerability [CWE-125] in the Performance Co-Pilot (PCP) pmproxy service. A remote, unauthenticated attacker can send a specially crafted request that bypasses a bounds check in the pmLogLoadInDom() function. Successful exploitation crashes the pmproxy service, resulting in a Denial of Service (DoS). The same flaw may also allow adjacent memory contents to be read, potentially disclosing sensitive information from process memory. The issue is network reachable and requires no user interaction.

Critical Impact
Remote unauthenticated attackers can crash the pmproxy service or leak process memory contents by sending a crafted request to a network-exposed PCP endpoint.

Affected Products

Performance Co-Pilot (PCP) pmproxy service
Red Hat distributions shipping vulnerable PCP builds (see Red Hat advisory for specific package versions)
Systems exposing pmproxy on network interfaces

Discovery Timeline

2026-07-30 - CVE-2026-16530 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-16530

Vulnerability Analysis

The flaw resides in pmLogLoadInDom(), a function within PCP responsible for loading instance domain (InDom) records from archive logs handled by pmproxy. A required bounds check on attacker-influenced length or index data is bypassed when the request is crafted with specific field values. As a result, the function reads past the end of an allocated buffer.

Two outcomes follow from the out-of-bounds read. First, the process may access unmapped memory and crash, terminating pmproxy and disrupting monitoring, metrics collection, and any dependent observability workflows. Second, when the read lands within mapped memory, response data returned to the client can include adjacent heap contents, exposing information such as prior request buffers, credentials, or internal state.

The attack vector is network based with low complexity and no privileges required. Confidentiality impact is limited because leakage is opportunistic rather than targeted, and integrity is not directly affected.

Root Cause

The root cause is missing or insufficient validation of length or offset values parsed from attacker-supplied input before they are used to index into a buffer inside pmLogLoadInDom(). This is a classic [CWE-125] out-of-bounds read pattern where trust in externally supplied metadata leads to reads beyond the intended object.

Attack Vector

An attacker with network reach to a pmproxy listener submits a malformed request whose embedded structure fields cause pmLogLoadInDom() to compute an out-of-range access. Repeatable requests can be used to crash the service on demand or to sample memory content across successive connections. Refer to the Red Hat CVE-2026-16530 Report and Red Hat Bug Report #2506033 for detailed technical context.

Detection Methods for CVE-2026-16530

Indicators of Compromise

Unexpected termination or repeated restarts of the pmproxy service in systemd or journalctl logs.
Segmentation fault entries referencing pmproxy or libpcp in kernel and audit logs.
Anomalous inbound traffic to pmproxy ports (default TCP 44322) from untrusted networks.
Malformed PCP protocol requests targeting archive log or InDom operations.

Detection Strategies

Monitor process supervision events for pmproxy crash-loop patterns following inbound requests.
Inspect network telemetry for external sources connecting to PCP listener ports.
Correlate pmproxy faults with preceding request payloads captured at the network edge.

Monitoring Recommendations

Alert on pmproxy service restarts exceeding a baseline threshold within a short interval.
Log and review all requests to pmproxy from outside authorized management subnets.
Track memory-mapped file access and abnormal read patterns from the pmproxy process.

How to Mitigate CVE-2026-16530

Immediate Actions Required

Restrict pmproxy exposure to trusted management networks using host firewall rules or network ACLs.
Apply vendor updates for PCP as soon as fixed packages are published by the distribution vendor.
Audit systems to inventory hosts running pmproxy and confirm which listeners are network reachable.
Rotate any credentials or secrets that may have transited process memory on affected hosts.

Patch Information

At the time of publication, consult the Red Hat CVE-2026-16530 Report for the authoritative list of fixed package versions and errata. Downstream distributions that ship PCP should be checked for corresponding updates before deployment.

Workarounds

Bind pmproxy to localhost only when remote access is not required, disabling network exposure.
Disable the pmproxy service on hosts that do not need PCP proxying functionality.
Place pmproxy behind an authenticating reverse proxy or VPN that restricts client access.
Enforce ingress filtering at the perimeter to block inbound traffic to PCP ports from untrusted sources.

bash

# Restrict pmproxy to loopback and block external access
sudo systemctl stop pmproxy
# Edit /etc/pcp/pmproxy/pmproxy.options to bind locally
echo '-i 127.0.0.1' | sudo tee -a /etc/pcp/pmproxy/pmproxy.options
sudo systemctl start pmproxy

# Firewall example (firewalld): drop external traffic to pmproxy port 44322
sudo firewall-cmd --permanent --add-rich-rule=\
  'rule family="ipv4" port port="44322" protocol="tcp" drop'
sudo firewall-cmd --reload