Skip to content
OpenAdvisories
Medium RLSA-2026:0930 2 CVEs

Moderate: pcs security update

Published Jan 23, 2026 · Updated Jan 23, 2026

Ecosystem: Rocky Linux

Summary

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* tornado: Tornado Quadratic DoS via Repeated Header Coalescing (CVE-2025-67725)

* tornado: Tornado Quadratic DoS via Crafted Multipart Parameters (CVE-2025-67726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 pcs 0:0.10.18-2.el8_10.8

Vulnerabilities 2

  • High 7.5
    CVE-2025-67725

    Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumula…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux Alpine PyPI
  • High 7.5
    CVE-2025-67726

    Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters

    Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse sp…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Alpine PyPI

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2421722
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2421733