The pcs packages in Red Hat Enterprise Linux 9 provide command-line configuration for Pacemaker and Corosync. This update fixes three DoS vulnerabilities in the rubygem-rack library: CVE-2024-25126 (Content-Type parsing), CVE-2024-26141 (Range header handling), and CVE-2024-26146 (header parsing). These vulnerabilities could allow an attacker to cause denial of service by sending specially crafted HTTP headers. Red Hat has released updated packages to address these issues as part of the Red Hat Enterprise Linux 9.4 update. No CVSS scores are provided in the advisory, but the impact is considered moderate.

Successful exploitation of these vulnerabilities could result in denial of service conditions affecting the pcs service, potentially disrupting cluster management operations relying on Pacemaker and Corosync. There is no indication of code execution or privilege escalation. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update for pcs in Red Hat Enterprise Linux 9 that addresses these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2024:2113 and the linked article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patch.