Pacemaker CVE-2026-10649

Upstream fix available (PR/commit https://github.com/clusterLabs/pacemaker/pull/4128); released patched version not independently confirmed, so administrators should track their distribution's Pacemaker package update (Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-10649 and Bugzilla #2462817 at https://bugzilla.redhat.com/show_bug.cgi?id=2462817, plus the oss-security thread at https://seclists.org/oss-sec/2026/q2/944) and upgrade as soon as a tagged release or vendor errata is published. Until a patched build is deployed, compensating controls are to restrict TCP/3121 (the Pacemaker remote / CIB remote listener port) to the dedicated cluster interconnect using host-based firewall rules (firewalld/iptables/nftables) and network ACLs, ensuring no exposure to user or untrusted networks; on hosts where Pacemaker Remote is not in use, disable the pacemaker_remote service and ensure the CIB does not enable remote-tls-port/remote-clear-port - the trade-off is loss of remote-node and pacemaker_remote functionality. Verify that TLS with PSK is configured for cluster remote communication, which raises the bar but does not by itself prevent the pre-authentication parse from reaching the vulnerable decompression code.