The pcs packages in Red Hat Enterprise Linux 9.0 Extended Update Support include rubygem-rack, which has three identified denial of service vulnerabilities: CVE-2024-25126 (Content-Type parsing), CVE-2024-26141 (Range header handling), and CVE-2024-26146 (header parsing). These vulnerabilities could allow an attacker to cause a denial of service condition. Red Hat has issued an update (pcs-0.11.1-10.el9_0.5) that addresses these issues. The advisory covers multiple architectures and variants of Red Hat Enterprise Linux 9.0 with Extended Update Support and Update Services for SAP Solutions.

Successful exploitation of these vulnerabilities could result in denial of service conditions affecting the pcs command-line configuration system for Pacemaker and Corosync. This may disrupt high availability and resilient storage services on affected Red Hat Enterprise Linux 9.0 systems. No known exploits in the wild have been reported at this time.

Red Hat has released updated pcs packages (version 0.11.1-10.el9_0.5) that fix the identified vulnerabilities. Users of Red Hat Enterprise Linux 9.0 Extended Update Support and related variants should apply these updates promptly. For detailed update instructions, refer to Red Hat's official guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.