Skip to content
OpenAdvisories
High ALSA-2025:20962 5 CVEs

Important: pcs security update

Published Nov 11, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)
* rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
* rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
* rack: Rack memory exhaustion denial of service (CVE-2025-61772)
* rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion (CVE-2025-61919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 9 pcs 0.11.10-1.el9_7.1
AlmaLinux · 9 pcs-snmp 0.11.10-1.el9_7.1

Vulnerabilities 5

  • High 7.5
    CVE-2025-59830

    Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters

    Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter …

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2025-61770

    Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

    Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble…

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2025-61771

    Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

    Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parser` stores non-file form fields (parts without a `filename`) entirely in memory as Ruby `String` objects. A single large text field in a multip…

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2025-61772

    Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

    Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser ke…

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2025-61919

    Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

    Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request body into memory for `Content-Type: application/x-www-form-urlencoded`, calling `rack.input.read(nil)` without enforcing a …

    rack rack kube-fluentd-operator rack Debian Ubuntu Wolfi RubyGems

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-59830
  • report
    https://access.redhat.com/security/cve/CVE-2025-61770
  • report
    https://access.redhat.com/security/cve/CVE-2025-61771
  • report
    https://access.redhat.com/security/cve/CVE-2025-61772
  • report
    https://access.redhat.com/security/cve/CVE-2025-61919
  • report
    https://bugzilla.redhat.com/2398167
  • report
    https://bugzilla.redhat.com/2402174
  • report
    https://bugzilla.redhat.com/2402175
  • report
    https://bugzilla.redhat.com/2402200
  • report
    https://bugzilla.redhat.com/2403180
  • advisory
    https://errata.almalinux.org/9/ALSA-2025-20962.html