CVE-2026-10649 — Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a special…
Published: 2026-06-16 · CVSS: 8.6 · CVSS 3.1
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7