The pcs packages for Red Hat Enterprise Linux 8.6 Extended Update Support include rubygem-rack dependencies that contain three denial of service vulnerabilities: CVE-2024-25126 (Content-Type parsing), CVE-2024-26141 (Range header handling), and CVE-2024-26146 (header parsing). These vulnerabilities could allow an attacker to cause a denial of service condition via crafted HTTP headers processed by Rack. Red Hat has issued security updates for pcs to remediate these vulnerabilities. The advisory references updated pcs packages version 0.10.12-6.el8_6.5 for multiple architectures and variants of RHEL 8.6 EUS.

Successful exploitation of these vulnerabilities could cause denial of service conditions in applications using the affected rubygem-rack component within pcs, potentially disrupting cluster management operations via Pacemaker and Corosync. There are no known exploits in the wild. The impact is rated moderate by Red Hat.

Red Hat has released updated pcs packages (version 0.10.12-6.el8_6.5) that address these vulnerabilities. Users should apply this security update after ensuring all previously released relevant errata have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are specified or required beyond applying the official update.