Skip to content
OpenAdvisories
High RHSA-2026:2465 3 CVEs

Red Hat Security Advisory: pcs security update

Published Feb 11, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::highavailability pcs 0:0.10.15-4.el8_8.10
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::highavailability pcs-snmp 0:0.10.15-4.el8_8.10
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::highavailability pcs 0:0.10.15-4.el8_8.10
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::highavailability pcs-snmp 0:0.10.15-4.el8_8.10

Vulnerabilities 3

  • High 7.5
    CVE-2025-67725

    Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumula…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux Alpine PyPI
  • High 7.5
    CVE-2025-67726

    Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters

    Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse sp…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Alpine PyPI
  • Medium 6.9
    CVE-2025-13465 Public exploit

    Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

    The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their ori…

    lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2421722
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2421733
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2431740
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2465.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-13465
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-13465
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-13465
  • article
    https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
  • report
    https://access.redhat.com/security/cve/CVE-2025-67725
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-67725
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-67725
  • article
    https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd
  • article
    https://github.com/tornadoweb/tornado/releases/tag/v6.5.3
  • article
    https://github.com/tornadoweb/tornado/security/advisories/GHSA-c98p-7wgm-6p64
  • report
    https://access.redhat.com/security/cve/CVE-2025-67726
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-67726
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-67726
  • article
    https://github.com/tornadoweb/tornado/security/advisories/GHSA-jhmp-mqwm-3gq8