Executive Summary

CVE-2026-10649 is an integer overflow vulnerability in Pacemaker's remote message decompression process. An unauthenticated remote attacker can send a specially crafted compressed message to the Pacemaker CIB remote listener before authentication completes. This crafted message triggers an integer overflow during size calculations for memory allocation, causing memory corruption.

The memory corruption leads to a crash of the affected service, resulting in a denial of service (DoS) condition. The vulnerability exists in the function handling remote messages and affects versions where the CIB remote listener is enabled.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service (DoS) by crashing the Pacemaker service responsible for managing cluster resources. An attacker can exploit this remotely without authentication, disrupting the availability of the service.

If your system uses Pacemaker with the CIB remote listener enabled, an attacker with network access to this listener can send malicious messages that cause the service to crash, potentially leading to downtime or loss of high availability in your cluster environment.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring network traffic for attempts to send specially crafted compressed remote messages to the Pacemaker CIB remote listener ports (configured with remote-port or remote-tls-port). Since the vulnerability is triggered before authentication, any unexpected or malformed compressed messages targeting these ports could indicate exploitation attempts.

Additionally, checking for crashes or denial of service conditions in the Pacemaker service logs related to remote message processing may help identify exploitation.

Specific commands are not provided in the available resources, but general network monitoring tools like tcpdump or Wireshark can be used to capture and analyze traffic on the relevant ports. For example:

• tcpdump -i <interface> port <remote-port>
• tcpdump -i <interface> port <remote-tls-port>

Reviewing Pacemaker logs for crashes or unusual errors related to remote message decompression can also help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling the Pacemaker CIB remote listener if it is not required, as the vulnerability can only be exploited if remote CIB administration is enabled.

If the remote listener is needed, restrict network access to the listener ports (remote-port or remote-tls-port) to trusted peers only, minimizing exposure to untrusted networks.

Monitor for updates or patches addressing this vulnerability and apply them as soon as they become available. The fix involves adding validation checks and safe memory allocation to prevent integer overflows.

Useful 0 Not Useful 0