The pcs packages in Red Hat Enterprise Linux 8 provide command-line configuration for Pacemaker and Corosync. A denial of service vulnerability (CVE-2026-31958) in the Tornado Python framework component of pcs allows an attacker to cause service disruption by sending large multipart bodies. Red Hat Product Security has rated this issue as moderate severity and released updated pcs packages to fix the vulnerability. The advisory references Red Hat Enterprise Linux High Availability and Resilient Storage variants on multiple architectures including x86_64, aarch64, s390x, and ppc64le. The fix is available in pcs version 0.10.18-2.el8_10.9.

Successful exploitation of this vulnerability can cause denial of service conditions in the pcs service, potentially disrupting cluster management operations in Red Hat Enterprise Linux High Availability and Resilient Storage environments. No evidence of active exploitation in the wild is reported.

Red Hat has released updated pcs packages (version 0.10.18-2.el8_10.9) that address this denial of service vulnerability. Users of affected Red Hat Enterprise Linux 8 High Availability and Resilient Storage variants should apply the provided security update as detailed in the Red Hat advisory RHSA-2026:8093. Refer to https://access.redhat.com/articles/11258 for update instructions. No additional mitigation steps are indicated by the vendor.