The pcs packages for Red Hat Enterprise Linux 8 provide command-line configuration for Pacemaker and Corosync. Two denial-of-service vulnerabilities have been identified and fixed: CVE-2025-46727 involves an unbounded-parameter denial of service in the Rack::QueryParser component of rubygem-rack, and CVE-2025-47287 involves a multipart form-data denial of service in tornado. Red Hat has issued an update (pcs-0.10.18-2.el8_10.5) that addresses these vulnerabilities across multiple architectures including x86_64, aarch64, s390x, and ppc64le. The advisory is classified as important, and detailed patch instructions are available from Red Hat.

Successful exploitation of these vulnerabilities could allow an attacker to cause denial of service conditions in applications using the affected rubygem-rack and tornado components within the pcs package environment. This could disrupt cluster management operations relying on Pacemaker and Corosync configuration, potentially impacting high availability and resilient storage services on affected Red Hat Enterprise Linux 8 systems.

Red Hat has released updated pcs packages (version 0.10.18-2.el8_10.5) that fix the identified vulnerabilities. Users of affected Red Hat Enterprise Linux 8 High Availability and Resilient Storage variants should apply these updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.