Skip to content
OpenAdvisories
Medium ELSA-2026-0930 2 CVEs

Moderate: pcs security update (Oracle Linux 8)

Published Jan 21, 2026 · Updated Jan 21, 2026

Ecosystem: Oracle Linux

Summary

[0.10.18-2.0.1.el8_10.8]
- Replaced HAM-logo

[0.10.18]
- Debrand PCS

[0.10.18-2.el8_10.8]
- Fixed CVE-2025-67725, CVE-2025-67726 by patching bundled Tornado
Resolves: RHEL-136415, RHEL-136420

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 8 pcs 0:0.10.18-2.0.1.el8_10.8
Oracle Linux · 8 pcs-snmp 0:0.10.18-2.0.1.el8_10.8

Vulnerabilities 2

  • High 7.5
    CVE-2025-67725

    Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumula…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux Alpine PyPI
  • High 7.5
    CVE-2025-67726

    Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters

    Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse sp…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Alpine PyPI