The pcs packages, which provide command-line configuration for Pacemaker and Corosync utilities in Red Hat Enterprise Linux 8, are affected by two Tornado web server quadratic denial-of-service vulnerabilities: CVE-2025-67725 (via repeated header coalescing) and CVE-2025-67726 (via crafted multipart parameters). These vulnerabilities can cause resource exhaustion leading to denial of service. Red Hat Product Security has rated these issues as moderate severity and released updated pcs packages in advisory RHSA-2026:0930 to fix them. The advisory includes packages for multiple architectures including x86_64, aarch64, s390x, and ppc64le, covering both standard and extended life cycle versions of Red Hat Enterprise Linux High Availability and Resilient Storage 8.

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial of service condition by triggering quadratic resource consumption in the Tornado web server components used by pcs. This could disrupt the availability of the pcs service and potentially impact cluster management operations relying on Pacemaker and Corosync. There are no known exploits in the wild at this time.

Red Hat has released updated pcs packages that address these vulnerabilities as detailed in advisory RHSA-2026:0930. Users of affected Red Hat Enterprise Linux 8 High Availability and Resilient Storage variants should apply the updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.