Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
pcs and pcs‑snmp may be slowed by crafted web requests
published 1 month ago
Summary
The pcs and pcs‑snmp packages include a web interface that can be overwhelmed or cause errors when an attacker sends specially formed or unusually large request data. This can make the service slow or stop working. Installing the latest update, which refreshes the bundled web library and adds safeguards, resolves the issue.
What to do
- Update centos pcs to version 0.10.8-1.el8.tuxcare.els1.
- Update centos pcs-snmp to version 0.10.8-1.el8.tuxcare.els1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:8.4 | centos | pcs |
< 0.10.8-1.el8.tuxcare.els1 Fix: upgrade to 0.10.8-1.el8.tuxcare.els1
|
| TuxCare:CentOS:8.4 | centos | pcs-snmp |
< 0.10.8-1.el8.tuxcare.els1 Fix: upgrade to 0.10.8-1.el8.tuxcare.els1
|
Original advisory text
pcs: Fix of 10 CVEs
- Update bundled rubygem rack to 2.2.20
- CVE-2024-25126: fix ReDoS in Rack::MediaType content type parsing
- CVE-2024-26141: fix response amplification from crafted Range headers
- CVE-2024-26146: fix ReDoS in Accept and Forwarded header parsing
- CVE-2025-46727: fix unbounded parameter count in Rack::QueryParser
- CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters
- CVE-2025-61770: fix unbounded multipart preamble buffering
- CVE-2025-61771: fix unbounded buffering of non-file multipart fields
- CVE-2025-61772: fix unbounded multipart part header buffering
- CVE-2025-61919: fix unbounded form body read in Rack::Request#POST
- Handle Rack::QueryParser::QueryLimitError in pcsd, returning 400 instead of 500
- CVE-2026-31958: cap multipart part count and part header size in bundled tornado
- Disable multipart request parsing in pcsd, which does not use it
- Drop i686 from ExclusiveArch: the bundled web UI needs npm at build time and
npm has no i686 build, so the i686 buildroot cannot be created
- CVE-2024-25126: fix ReDoS in Rack::MediaType content type parsing
- CVE-2024-26141: fix response amplification from crafted Range headers
- CVE-2024-26146: fix ReDoS in Accept and Forwarded header parsing
- CVE-2025-46727: fix unbounded parameter count in Rack::QueryParser
- CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters
- CVE-2025-61770: fix unbounded multipart preamble buffering
- CVE-2025-61771: fix unbounded buffering of non-file multipart fields
- CVE-2025-61772: fix unbounded multipart part header buffering
- CVE-2025-61919: fix unbounded form body read in Rack::Request#POST
- Handle Rack::QueryParser::QueryLimitError in pcsd, returning 400 instead of 500
- CVE-2026-31958: cap multipart part count and part header size in bundled tornado
- Disable multipart request parsing in pcsd, which does not use it
- Drop i686 from ExclusiveArch: the bundled web UI needs npm at build time and
npm has no i686 build, so the i686 buildroot cannot be created
References
- https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1790610331.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-25126 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-26141 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-26146 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-46727 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-59830 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61770 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61771 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61772 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61919 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-31958 Vendor Advisory
Timeline
Published28 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1790610331 · OSV
Track software like this
Free during beta