The pcs packages in Red Hat Enterprise Linux 9.2 Extended Update Support include rubygem-rack, which contains three denial of service vulnerabilities: CVE-2024-25126 (content-type parsing), CVE-2024-26141 (range header handling), and CVE-2024-26146 (header parsing). These vulnerabilities could allow an attacker to cause a denial of service condition. Red Hat has issued an update (pcs-0.11.4-7.el9_2.1) that addresses these issues. The advisory rates the impact as moderate and provides updated packages for multiple architectures and variants of RHEL 9.2.

Successful exploitation of these vulnerabilities could result in denial of service conditions affecting the pcs service, potentially disrupting configuration management of Pacemaker and Corosync clusters. There are no known exploits in the wild. The impact is rated moderate by Red Hat.

Red Hat has released updated pcs packages (version 0.11.4-7.el9_2.1) that fix the identified vulnerabilities. Users of affected Red Hat Enterprise Linux 9.2 Extended Update Support variants should apply these updates promptly. For detailed update instructions, refer to Red Hat's official article: https://access.redhat.com/articles/11258. No additional mitigation is required beyond applying the official patches.