A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2742-1 advisory.

    This update for pacemaker fixes the following issue

    - CVE-2026-10649: denial of service via integer overflow in remote message decompression (bsc#1268381).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21196-1 advisory.

    - CVE-2026-10649: Fixed denial of service via integer overflow in remote message decompression     (bsc#1268381).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2719-1 advisory.

    - CVE-2026-10649: Fixed denial-of-service via integer overflow in remote message decompression     (bsc#1268381).

    Changes for pacemaker:

    - Update to version 2.1.10+20260618.4bca25e3c1:

      - libcrmcommon: Add additional checks to pcmk__remote_message_xml. (Crh#2462817,     gh#ClusterLabs/pacemaker#4133)
      - libcib: Remove an unnecessary coverity suppression. (Crh#2462817, gh#ClusterLabs/pacemaker#4133)
      - libcrmcommon: Fix an integer overflow in pcmk__remote_send_xml. (Crh#2462817,     gh#ClusterLabs/pacemaker#4133)
      - libcrmcommon: Limit the max size of a remote message. (Crh#2462817, gh#ClusterLabs/pacemaker#4133)
      - libcrmcommon: Fix integer overflow in remote message code. (Crh#2462817,     gh#ClusterLabs/pacemaker#4133)
      - libcrmcommon: Add sanity checks to localized_remote_header. (Crh#2462817,     gh#ClusterLabs/pacemaker#4133)
      - libcrmcommon: Fix a glib logging build error
      - libcrmcommon, libpacemaker: Don't assign const char * to char *

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2701-1 advisory.

    This update for pacemaker fixes the following issue

    - CVE-2026-10649: denial of service via integer overflow in remote message decompression (bsc#1268381).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2716-1 advisory.

    This update for pacemaker fixes the following issue

    - CVE-2026-10649: denial of service via integer overflow in remote message decompression (bsc#1268381).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2c31df81dc advisory.

    ```
    * Wed Jun 17 2026 Klaus Wenninger <klaus.wenninger@aon.at> - 3.0.2-3
    - fix CVE-2026-10649: Fix integer overflows in remote message code     ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6a4bfb1309 advisory.

    ```
    * Wed Jun 17 2026 Klaus Wenninger <klaus.wenninger@aon.at> - 3.0.2-3
    - fix CVE-2026-10649: Fix integer overflows in remote message code     ```


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow     vulnerability in the remote message decompression process. By sending a specially crafted compressed     remote message before authentication, an attacker can cause memory corruption, leading to a denial of     service (DoS) in the CIB remote listener. This can result in the affected service crashing.
    (CVE-2026-10649)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325157	SUSE SLES15: libpacemaker-devel / libpacemaker3 / pacemaker / pacemaker-cli / etc (SUSE-SU-2026:2742-1)	Nessus	SuSE Local Security Checks	high
325047	openSUSE 16: pacemaker / pacemaker-cli / pacemaker-cts / pacemaker-devel / etc (openSUSE-SU-2026:21196-1)	Nessus	SuSE Local Security Checks	high
324875	SUSE SLES15: pacemaker / pacemaker-cli / pacemaker-cts / pacemaker-devel / etc (SUSE-SU-2026:2719-1)	Nessus	SuSE Local Security Checks	high
324849	SUSE SLES15: pacemaker / pacemaker-cli / pacemaker-cts / pacemaker-devel / etc (SUSE-SU-2026:2701-1)	Nessus	SuSE Local Security Checks	high
324842	SUSE SLES15: pacemaker / pacemaker-cli / pacemaker-cts / pacemaker-devel / etc (SUSE-SU-2026:2716-1)	Nessus	SuSE Local Security Checks	high
323129	Fedora 44 : pacemaker (2026-2c31df81dc)	Nessus	Fedora Local Security Checks	high
323126	Fedora 43 : pacemaker (2026-6a4bfb1309)	Nessus	Fedora Local Security Checks	high
321217	Linux Distros Unpatched Vulnerability : CVE-2026-10649	Nessus	Misc.	high

Detections

Analytics

CVE-2026-10649

high

Tenable Plugins

high

high

high

high

high

high

high

high