Skip to content
OpenAdvisories
High ELSA-2025-20962 5 CVEs

Important: pcs security update (Oracle Linux 9)

Published Nov 25, 2025 · Updated Nov 25, 2025

Ecosystem: Oracle Linux

Summary

[0.11.10-1.el9_7.1]
- Fixed CVE-2025-59830, CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61919 by updating bundled rubygem rack
Resolves: RHEL-120945, RHEL-121035, RHEL-123630, RHEL-123642, RHEL-124938

[0.11.10-1]
- Rebased pcs to the latest sources (see CHANGELOG.md)
Resolves: RHEL-77194, RHEL-92044
- Updated pcs-web-ui to 0.1.23 (see CHANGELOG_WUI.md)
Resolves: RHEL-76309, RHEL-99805
- There is now a changelog for the pcsd web UI
Resolves: RHEL-86233
- Fixed directory permissions for RHEL Image Mode
Resolves: RHEL-97220
- Updated bundled rubygem rack

[0.11.9-3]
- Rebased pcs to the latest sources (see CHANGELOG.md)
Resolves: RHEL-35420, RHEL-76055, RHEL-76059, RHEL-76060, RHEL-76153, RHEL-76154, RHEL-76170, RHEL-76177, RHEL-82894
- Rebased pcs-web-ui to the latest sources
Resolves: RHEL-76310, RHEL-76311, RHEL-76312, RHEL-79317, RHEL-85196, RHEL-85197, RHEL-85745
- The upstream version of pcs-web-ui can now be queried through RPM - see bundled(pcs-web-ui)
Resolves: RHEL-86229
- Updated bundled rubygems: backports, childprocess, ffi, puma, rack, rack-protection, rack-session, rack-test, sinatra, tilt
Resolves: RHEL-90151
- Bundled rubygem logger

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 9 pcs 0:0.11.10-1.el9_7.1
Oracle Linux · 9 pcs-snmp 0:0.11.10-1.el9_7.1

Vulnerabilities 5

  • High 7.5
    CVE-2025-59830

    Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters

    Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter …

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2025-61770

    Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

    Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble…

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2025-61771

    Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

    Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parser` stores non-file form fields (parts without a `filename`) entirely in memory as Ruby `String` objects. A single large text field in a multip…

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2025-61772

    Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

    Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser ke…

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2025-61919

    Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

    Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request body into memory for `Content-Type: application/x-www-form-urlencoded`, calling `rack.input.read(nil)` without enforcing a …

    rack rack kube-fluentd-operator rack Debian Ubuntu Wolfi RubyGems