Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux PCS and PCS‑SNMP can be overloaded by crafted requests
published 20 days ago
Summary
The PCS and PCS‑SNMP components in AlmaLinux can be tricked into consuming excessive memory or bypassing limits when processing specially crafted multipart data or parameter strings. This could let an attacker slow down or disrupt the service. Apply the latest updates from AlmaLinux to fix the issue.
What to do
- Update almalinux pcs to version 0.11.4-7.el9_2.tuxcare.els4.
- Update almalinux pcs-snmp to version 0.11.4-7.el9_2.tuxcare.els4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.2 | almalinux | pcs |
< 0.11.4-7.el9_2.tuxcare.els4 Fix: upgrade to 0.11.4-7.el9_2.tuxcare.els4
|
| TuxCare:AlmaLinux:9.2 | almalinux | pcs-snmp |
< 0.11.4-7.el9_2.tuxcare.els4 Fix: upgrade to 0.11.4-7.el9_2.tuxcare.els4
|
Original advisory text
pcs: Fix of 7 CVEs
- CVE-2025-61772: fix unbounded multipart part header buffering
- CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters
- CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters
References
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792125039.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-38900 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-25126 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-46727 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-59830 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61770 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61771 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61772 Vendor Advisory
Timeline
Published16 Oct 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1792125039 · OSV
Track software like this
Free during beta