The pcs packages in Red Hat Enterprise Linux provide command-line configuration for Pacemaker and Corosync. Several security flaws have been identified and fixed: CVE-2025-59830 involves an unsafe default in rubygem-rack's QueryParser allowing bypass of params_limit via semicolon-separated parameters; CVE-2025-61770, CVE-2025-61771, and CVE-2025-61772 concern Rack's multipart parser and preamble buffering which can lead to unbounded memory consumption and denial of service; CVE-2025-61919 describes an unbounded read in Rack::Request form parsing causing memory exhaustion. These vulnerabilities can be exploited to cause denial of service through memory exhaustion or bypass parameter limits. Red Hat has issued security advisories and updates to address these issues in multiple versions of Red Hat Enterprise Linux High Availability.

The vulnerabilities can lead to denial of service conditions by exhausting system memory due to unbounded buffering and parsing in Rack and rubygem-rack components. Additionally, an unsafe default in QueryParser allows bypassing parameter limits, potentially impacting application behavior. These issues affect the stability and availability of systems running the affected pcs packages in Red Hat Enterprise Linux High Availability environments.

Red Hat has released security updates that fix these vulnerabilities. Users should apply the provided patches and updates as detailed in the Red Hat advisories RHSA-2025:19513 and RHSA-2025:19734. The advisories include updated package versions for affected Red Hat Enterprise Linux High Availability releases. Applying these official fixes will mitigate the described security issues.