The pcs packages in Red Hat Enterprise Linux 8.6 High Availability provide command-line configuration for Pacemaker and Corosync. This advisory fixes two denial-of-service vulnerabilities: CVE-2025-46727, an unbounded-parameter DoS in Rack::QueryParser within rubygem-rack, and CVE-2025-47287, a multipart form-data DoS in tornado. These vulnerabilities could allow an attacker to cause a denial of service via crafted input. Red Hat has released updated pcs packages (version 0.10.12-6.el8_6.8) for affected architectures including x86_64 and ppc64le. The advisory references Red Hat article 11258 for update instructions and classifies the impact as Important.

Successful exploitation of these vulnerabilities could result in denial of service conditions affecting the pcs configuration system for Pacemaker and Corosync on Red Hat Enterprise Linux 8.6 High Availability systems. This may disrupt cluster management operations relying on these utilities. There is no indication of code execution or data compromise. No known exploits in the wild have been reported at this time.

Red Hat has released updated pcs packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 8.6 High Availability should apply the provided updates (pcs-0.10.12-6.el8_6.8) as detailed in Red Hat article https://access.redhat.com/articles/11258. Applying these updates will mitigate the denial-of-service vulnerabilities. No additional mitigation steps are specified or required beyond applying the official patches.