CVE-2026-10649: Pacemaker Remote Message Integer Overflow DoS

Technical summary

CVE-2026-10649 exploits an integer overflow condition in Pacemaker's remote message decompression handler. The vulnerability exists in the pre-authentication message processing path, meaning the CIB remote listener processes and decompresses user-supplied compressed data before validating credentials. Integer overflow during decompression calculations leads to heap buffer corruption, causing the listening process to crash. The flaw is rooted in insufficient bounds checking or arithmetic validation during the decompression of remote cluster communication frames (CWE-190: Integer Overflow or Wraparound).

Business impact

A successful exploit results in service unavailability for the affected Pacemaker node's cluster coordination functions. The CIB remote listener is critical for inter-node cluster state synchronization and failover decisions. Repeated or distributed attacks could destabilize cluster health, delay failover responses, or prevent new nodes from joining the cluster. Organizations relying on Pacemaker for database replication, virtual machine orchestration, or other high-availability workloads face degraded resilience and potential cascading failures if this vulnerability is not patched.

Affected systems

This vulnerability affects Pacemaker installations with enabled remote cluster communication. The attack surface includes any Pacemaker node with a publicly or internally accessible remote listener port. Clusters configured to accept remote joins or remote monitoring are at highest risk. No specific product version constraints are provided in the vulnerability record; verify the affected version range and applicable patches against the official Pacemaker security advisory.

Exploitability

Exploitability is high. The flaw requires only unauthenticated network access—no user interaction, credentials, or special system configuration. An attacker can craft a malicious compressed message and send it to the remote listener port to trigger the integer overflow. The straightforward attack methodology and lack of barriers to attempt exploitation make this readily exploitable by network-adjacent threat actors. The CVSS 3.1 score of 8.6 (HIGH severity) reflects this low barrier to exploitation combined with significant availability impact.

Remediation

Apply the security patch released by the Pacemaker project for CVE-2026-10649. Patch availability and version details should be verified against the official Pacemaker security advisory. Until patching is possible, restrict network access to the Pacemaker remote listener port (typically port 5555) using firewall rules, allowing only trusted cluster nodes and management systems to connect. Disable remote joining if not operationally necessary. Monitor cluster logs for unexpected disconnections or listener crashes as potential signs of exploitation attempts.

Patch guidance

Check the Pacemaker project's official security advisory and release notes to identify the patched version for your deployment. Apply updates in a controlled manner: test patches in a non-production cluster environment first, then perform staged rolling updates across production nodes to maintain availability during patching. Verify cluster stability and quorum after each node update. Coordinate patching with your maintenance windows to minimize business disruption.

Detection guidance

Monitor Pacemaker logs (typically in /var/log/pacemaker or journalctl) for CIB remote listener crashes, segmentation faults, or sudden disconnections. Network detection should focus on identifying malformed or anomalous compressed message traffic to the remote listener port from unexpected sources. Intrusion detection systems can alert on network patterns consistent with fuzzing or integer overflow exploitation attempts targeting cluster ports. Process-level monitoring for unexpected terminations of the pacemaker-remoted or crmd processes may indicate exploitation.

Why prioritize this

This vulnerability warrants immediate patching due to its network accessibility, lack of authentication barriers, and direct impact on cluster availability. Pacemaker underpins critical infrastructure for many organizations; its compromise can cascade into unavailability of databases, virtualization platforms, and other HA services. The HIGH severity CVSS score, combined with the ease of exploitation, justifies prioritization above many other vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 8.6 reflects: (1) Network vector—remotely exploitable with no special access; (2) Low complexity—straightforward crafting of malicious compressed data; (3) No privilege requirement—pre-authentication exploitation; (4) High availability impact—service crash and cluster disruption; (5) Low confidentiality and integrity impact from the integer overflow itself, though cluster state inconsistency could follow. The absence of CVSS temporal adjustments (no KEV status or known exploitation) leaves the base score at 8.6, positioning it as HIGH severity and operationally significant.

Frequently asked questions