{"id":"SUSE-SU-2026:24251-1","summary":"Security update for pacemaker","details":"This update for pacemaker fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2026-10649: denial of service via integer overflow in remote message decompression (bsc#1268381).\n\nChanges for pacemaker:\n\nUpdate to version 3.0.3+20260728.7052efa194:\n\n- cts: make cts-scheduler -o/--out-dir default to a temporary directory (bsc#1272452)\n- spec: Add symlinks for test support files in the pacemaker-cts sub-package (bsc#1272452)\n- cts: Do not install test support files into /usr at runtime (bsc#1272452)\n- libcrmcommon: Make pcmk__auto_fencing_watchdog_timeout() static\n- libcrmcommon: Functionize parsing \"fencing-watchdog-timeout\"\n- liblrmd: Check watchdog-based self-fencing device for remote nodes only if \"fencing-watchdog-timeout\" is enabled (bsc#1270354, gh#ClusterLabs/pacemaker#4146)\n- controller: Check for watchdog-based self-fencing device only if \"fencing-watchdog-timeout\" is enabled (bsc#1270354, gh#ClusterLabs/pacemaker#4146)\n- fencer: Avoid use-after-free in debug log (bsc#1279543, gh#ClusterLabs/pacemaker#4172)\n- fenced: Prevent segfault by not merging with in-flight fencing actions (bsc#1271652, gh#ClusterLabs/pacemaker##4152)\n- ChangeLog: update for 3.0.3 release\n- Build: update version information for 3.0.3\n- libraries: update shared object versions for 3.0.3\n- NLS: update translations before 3.0.3-rc1\n- cibadmin: allow altering status section without triggering refresh (gh#ClusterLabs/pacemaker#4147)\n- tools: Use g_spawn_sync in cibsecret.\n- tools: Handle UTF-8 parameters in crm_resource.\n- tools: Handle UTF-8 parameters in cibsecret.\n- agents: Move pid file management into ClusterMon.in.\n- libcib: Remove an unnecessary coverity suppression. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)\n- libcrmcommon: Fix an integer overflow in pcmk__remote_send_xml. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)\n- libcrmcommon: Limit the max size of a remote message. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)\n- libcrmcommon: Fix integer overflow in remote message code. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)\n- libcrmcommon: Fix checks in localized_remote_header. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)\n- liblrmd: Don't include internal header in lrmd.h\n- Low: libcrmcommon, tools: Fix NULL dereference in crm_resource.c\n- pacemakerd: Properly find and track all existing sub-daemons (bsc#1265201, gh#ClusterLabs/pacemaker#4115)\n- tools: Use the VERSION variable instead of invoking `crm_attribute --version` (bsc#1265183, gh#ClusterLabs/pacemaker#4114)\n- libcib: Handle cib_xpath_address for an XPath query for an attribute (gh#ClusterLabs/pacemaker#4108)\n- libcib: Prevent based or cibadmin from crashing when handling an XPath query for an attribute (bsc#1249217, gh#ClusterLabs/pacemaker#4108)\n- libcrmcommon: Deprecate PCMK_dh_max_bits.\n- libcib: Full-CIB replace op no longer segfaults with cib_xpath\n- libpe_status: Avoid leaking a pcmk_resource_t's xml/orig_xml\n- Revert \"API: libraries: Update version numbers in so names\"\n- ChangeLog: update for 3.0.2-rc1 release\n- tools: Avoid memory leak in crm_resource --clear\n- libpacemaker, tools: Avoid mem leak in crm_simulate/pcmk_simulate()\n- libcib: Avoid memory leak when processing CIB upgrade\n- libpe_status: Use first operations child when expanding template\n- libpe_status: Improve no resources message in unpack_template()\n- daemons: Only log a message if we're falling back.\n- update version information for 3.0.2\n- libraries: Update version numbers in so names\n- libraries: update shared object versions for 3.0.2\n- NLS: update translations before 3.0.2-rc1\n- libcrmcommon: Deprecate anonymous authentication.\n- libcrmcommon: Deprecate remote-clear-port.\n- libcib: Add support for PSK authentication for remote CIB ops.\n- daemons: Add support for PSK authentication for remote CIB ops.\n- libpacemaker: Fix a memory leak in inject_action.\n- tools: Free the list at the end of cli_resource_print_operations.\n- tools: Fix memory leaks when printing crm_verify warnings/errors.\n- libpe: If pe__clone_default exits early, free the lists.\n- libpacemaker: Fix a segfault in order_resource_actions_after.\n- libcrmcommon: Properly return errno from pcmk__bare_output_new.\n- libpe: Free elements of rsc-\u003epriv-\u003eticket_constraints...\n- libpacemaker: If process_rsc_history exits early, free the list.\n- daemons,libcib: Fix memory leaks in IPC code.\n- libservices: Deal with fgets errors in services__get_lsb_metadata.\n- libpacemaker: Check that instance is not NULL.\n- libcrmcommon: Avoid overflow when negating INT_MIN\n- libcrmcommon: Avoid overflow in crm_time_add_months()\n- libcib: Explicitly handle receiving a NACK from based.\n- libcib: Explicitly handle receiving a NACK from fenced.\n- daemons: Don't NACK an invalid remote message.\n- libcrmcommon: Don't log on error in pcmk__ipc_send_iov.\n- daemons: Don't return a NACK if execd gets an unknown message.\n- liblrmd: Explicitly handle receiving a NACK from execd.\n- liblrmd: Fix log messages in remote_proxy_cb.\n- daemons: Delay creating an xmlNode in handle_register_request.\n- libcrmcommon: Ignore empty time spec\n- tools: Don't wait on certain \"pending\" monitor actions. (gh#ClusterLabs/pacemaker#4073)\n- libcrmcommon: Create a log file if it doesn't exist.\n- fencer: Disable watchdog-based self-fencing if \"fencing-watchdog-timeout\" is unset (gh#ClusterLabs/pacemaker#4067)\n- fencer: Make the deprecated \"stonith-watchdog-timeout\" option work again (gh#ClusterLabs/pacemaker#4068)\n- libcrmcommon: Move deprecatd PCMK_OPT_STONITH_TIMEOUT back to options.h\n- pacemakerd: Correctly detect ping requests from sbd (gh#ClusterLabs/pacemaker#4066)\n- libcrmcommon: Improve message for qb_log_file_open() fail\n- libcrmcommon: Improve pcmk__add_logfile() message for fopen() fail\n- libcrmcommon: More specific error for set_logfile_permissions()\n- libcrmcommon: Improve validation of PCMK_logfile_mode\n- liblrmd: Don't assert if queue_time is \u003c 0.\n- based: Don't log specially for PCMK__XA_CIB_UPDATE\n- controller: Don't treat patchset-apply errors as OK\n- libcrmcommon: xml_apply_patchset doesn't return diff_resync err\n- libcib: Don't convert -pcmk_err_diff_resync to pcmk_ok\n- libcrmcommon: Handle NULL PCMK_XA_FORMAT and PCMK_XA_DIGEST\n- libcib, tools: Empty CIB contains admin_epoch before epoch\n- daemons: Fix user/group checking in based.\n- libcrmcommon: Fix a glib logging build error.\n- libcrmcommon: Don't delete unchanged attributes when applying patch\n- libcrmcommon: Fix potential use-after-free and double-free (gh#ClusterLabs/pacemaker#4044)\n- executor: Fix the typos in the logs.\n- libcrmcommon: Set config warnings on mismatched ACL perm specs\n- libcrmcommon: xml_acl_filtered_copy() returns false for NULL source (gh#ClusterLabs/pacemaker#4039)\n- libcrmcommon: Make parse_acl_entry() non-recursive\n- libcrmcommon: Set config warnings and errors for acl_permission\n- libcib: Log correct error message in replace_cib()\n- libcib: Fix setting origin attributes in CIB updates (gh#ClusterLabs/pacemaker#4028)\n- tools: Drop crm_attribute --inhibit-policy-engine/-i option\n- libcrmcommon: Fix memory leak in pcmk__read_series_sequence() (gh#ClusterLabs/pacemaker#4032)\n- liblrmd: Check that pcmk__init_tls doesn't set native-\u003etls to NULL.\n- tools: Drop crm_attribute --attr-value/--delete-attr options\n- tools: Drop crm_attribute --attr-id option\n- based: Drop unhelpful trace messages\n- based: Improve a log message for IPC call options\n- libcib: {add,del}_notify_callback support only cib_diff_notify\n- based: Return correct code from write_cib_async()\n- daemons: Use crm_ipc_client_response in lrmd_remote_client_msg.\n- daemons: Set ipc_flags in lrmd_remote_client_msg to 0.\n- daemons: Clean up XML memory in IPC dispatch functions.\n- daemons: Fix a segfault displaying fencer metadata.\n- based: Drop redundant messages from based_diff_notify()\n- build: Handle CMocka deprecations\n- various: Always NULL-check return value of pcmk__find_client()\n- libcrmcommon: Improve messages in child_kill_helper()\n- tools: Free memory in crm_resource.c:handle_metadata()\n- pacemakerd: Use g_str_has_prefix() in handle_ping_request()\n- libpacemaker: Correctly check node types in pcmk__list_nodes()\n- pacemakerd: Match correctly in PCMK_{valgrind,callgrind}_enabled\n- libcrmcommon: Match correctly in PCMK_debug, stderr, blackbox\n- spec: Requires libxml2-tools since DLM controld RA requires xmllint (bsc#1259345)\n- daemons: Fix a typo if no existing attrd is found.\n- daemons: Call pcmk_cluster_disconnect at the end of fenced.\n- libcrmcommon: Fix underflow in crm_time_add_days()\n- libcrmcommon: Avoid integer overflow in seconds_to_hms()\n- spec: do not treat fillup templates as configuration files\n- build: install the default logrotate config into /usr/etc/logrotate.d\n- build: create directories in /var via tmpfiles.d\n- build: create hacluster user and haclient group via sysusers.d\n- agents: Deprecate allow_stonith_disabled param for controld RA\n- agents: New allow_fencing_disabled param for controld RA\n- agents: Use case-insensitive property matching in controld RA\n- schemas: Deprecate stonith-timeout-ms in crm_mon output\n- schemas: Deprecate stonith-enabled in crm_mon output\n- various: New fencing-timeout-ms in crm_mon/pcmk_status output\n- schemas: New fencing-timeout-ms attribute in crm_mon schema\n- various: New fencing-enabled in crm_mon/pcmk_status output\n- schemas: New fencing-enabled attribute in crm_mon schema\n- tools: cibadmin --xpath --delete-all deletes all matches again\n- various: Use const for a few string pointer variables\n- cts: Respect cts-lab --nic option if specified for IPv4 (gh#ClusterLabs/pacemaker#3986)\n- cts: cts-lab --nic option defaults to eth0 only for an IPv6 link local address (gh#ClusterLabs/pacemaker#3986)\n- controller: Ask attribute manager to purge fenced nodes' attributes\n- controller: Don't purge transient attributes on node loss (gh#ClusterLabs/pacemaker#3991)\n- controller: Allow purging node attrs without cache removal\n- controller: don't need to erase node attributes for remote nodes\n- pacemaker-attrd: Drop \"requesting shutdown\" code\n- pacemaker-attrd: Wipe CIB along with memory (gh#ClusterLabs/pacemaker#3991)\n- libcrmservice: Correctly check the return value of stat.\n- fencer: Improve validation of pcmk_host_map\n- fencer: Drop support for escaped characters in pcmk_host_map\n- fencer: Drop unhelpful message from build_port_aliases()\n- fencer: Fix ISO 8601 interval parsing in pcmk_delay_base\n- daemons: When checking for duplicate messages, we might be prepending.\n- daemons: Don't add repeated I_PE_CALC messages to the fsa queue.\n- scheduler:\tpromoted state with promoted state with attribute\n- fencer: Log an error for empty pcmk_delay_base mapping key\n- fencer: Fix a format string\n- libcrmservice: List only the requested directory contents\n- build, libcrmservice: initdir must be a single directory\n- libcrmservice: Fix memory leaks when listing directory contents\n- cts: Add cts-lab --nic option used for generated IP address resources (gh#ClusterLabs/pacemaker#3982)\n- libcrmcommon: Loop on EAGAIN in mainloop_gio_callback.\n- daemons: Get rid of some logged warnings in execd.\n- libcrmcommon: Bump feature set to 3.20.5\n- libcrmcommon: Deprecate stop-removed-resources cluster property\n- libcrmcommon: Deprecate cancel-removed-actions cluster property\n- libpe_status: Warn if concurrent-fencing is false\n- libcrmcommon: Deprecate enable-startup-probes cluster property\n- libcrmcommon: Rename stop-removed-actions to cancel-removed-actions\n- libcrmcommon: Deprecate cluster-ipc-limit cluster option\n- cts-cli: Escape special characters in the path for a pattern (gh#ClusterLabs/pacemaker#3971)\n- tools: Handle large timeouts correctly in crm_resource --wait\n- controller: NULL-check lrm_state before dereferencing it\n- tools: cibsecret should work with CIB_file set.\n- controller: Avoid \"stonith\" in log messages\n- tools: Use \"fencing\" in stonith_admin/crm_resource\n- libpe_status: Use \"fencing\" instead of \"STONITH\" in some logs\n- libcrmcommon: New \"fencing-reaction\" cluster property\n- libcrmcommon: New \"fencing-watchdog-timeout\" cluster property\n- libcrmcommon: New \"fencing-timeout\" cluster property\n- libcrmcommon: New \"fencing-max-attempts\" cluster property\n- libcrmcommon: New \"fencing-action\" cluster property\n- libcrmcommon: New \"fencing-enabled\" cluster property\n- libcrmcommon: Update documentation for cluster-ipc-limit.\n- libcrmcommon: Be more lenient in evicting IPC clients.\n- tools: Deprecate iso8601 command line tool\n- libcrmcommon: Show deprecated option aliases in outputs\n- libcrmcommon: Parse iso8601 strings according to spec.\n- fencer: Prevent unsigned int overflow in get_action_timeout()\n- libcrmcommon: Fix integer overflow of alert timeouts\n- libcrmcommon: Ensure stonith watchdog timeout is in long range\n- controller, fencer: Ignore negative/unparsable pcmk_monitor_timeout\n- cts: Drop cts script\n- tools: Drop crm_report -T/--cts and --cts-log options\n- schemas: Deprecate \"orphaned\" attribute\n- schemas: resource XML element has new \"removed\" attribute\n- schemas: Deprecate \"orphan\" attribute in crm_mon and crm_simulate\n- schemas: resource_history XML element has new \"removed\" attribute\n- libcrmcommon: Fix a segfault in internal_ipc_get_reply. (bsc#1255371, gh#ClusterLabs/pacemaker#3949)\n- libcrmcommon: New \"stop-removed-resources\" cluster property\n- libcrmcommon: New \"stop-removed-actions\" cluster property\n- sysconfig: Remove --leak-check=full from default VALGRIND_OPTS.\n- tools: Hide crm_mon --as-xml option\n- crm_mon: Deprecate --pid-file/-p option\n- tools: Fix CIB validation in crm_mon.c\n- libcib, libcrmcommon: Improve a couple of log messages\n- libcrmcommon: pcmk__quote_cmdline() returns valid shell string\n- libcrmcommon: Bump feature set to 3.20.4\n- schemas: Add a schema for cibadmin\n- tools: Use formatted output in cibadmin\n- tools: Formatted output for cibadmin --show-access --query\n- tools: Formatted output for cibadmin --node-path\n- tools: Basic cibadmin XML formatted output\n- tools: Formatted output for cibadmin --empty\n- tools: Formatted output for cibadmin --md5-sum{,-versioned}\n- tools: Deprecate cibadmin -e/--node-path option\n- libcrmcommon: bump feature set to 3.20.3\n- schemas: Add a schema for cibsecret.\n- libcrmcommon: Return a value for md5sum of empty input.\n- tools: Remove the shell version of cibsecret.\n- tools: Improve some cibadmin error messages\n- tools: cibadmin renders ACLs only when output is cib element\n- tools: cibadmin now errors if unable to compute md5 sum\n- libcib, tools: Resolve cibadmin TODO re: ACL rendering and input\n- controller: Avoid crash due to GSource double-free\n- tools: Deprecate cibadmin -N/--node option\n- tools: Drop \"Digest: \" from cibadmin --md5-sum stderr\n- tools: cibadmin ignores --node-path for non-XPath-query command\n- tools: Change exit codes for failure to create cib_t object\n- libcib: Fix cib__signon_retry() return code\n- tools: Deprecate cibadmin --show-access as non-privileged user\n- tools: Don't require --force for non-privileged cibadmin ACLs\n- tools: Default cibadmin command is now --query\n- tools: Deprecate current input source precedence in cibadmin\n- tools: Drop cibadmin --extended-version/-! option\n- libcrmcommon: Bump feature set to 3.20.2\n- schemas: Add a schema for crm_diff\n- tools: Use formatted output in crm_diff.c\n- libcrmcommon: Standardize remote environment variable parsing\n- libcrmcommon: Allow empty string values in pcmk__scan_nvpair()\n- libcrmcommon: Keep trailing newlines in pcmk__scan_nvpair()\n- fencer: Fix fence delay range off-by-one\n- daemons: Return CRM_EX_PROTOCOL when ACKing an unknown request.\n- daemons: Correct result error string on unknown IPC messages.\n- daemons: Add a return to do_pe_invoke_callback.\n- tools: Deprecate crm_diff --stdin\n- tools: Improve error handling in crm_diff.c\n- tools: Be stricter about crm_diff --cib/--no-version\n- libcrmcommon: Don't require version info when applying CIB patches\n- agents: Error check calling attrd_updater in HealthSMART.\n- agents: Error check calling attrd_updater in HealthIOWait.\n- agents: Error out if CPU I/O wait time isn't available.\n- agents: Error check calling attrd_updater in HealthCPU.\n- agents: Error out if CPU idleness isn't available.\n- daemons: Don't log the unresponsive message for a daemon we killed\n- controller: Avoid blocking wait in controller for CIB re-request\n- cts: Remove --valgrind-tests\n- cts: Leave valgrind results around if they're not empty.\n- NLS: update translations before 3.0.1-rc1\n- libpacemaker: Prevent CIB growth during crm_simulate --profile\n- daemons: Fix a toctou bug when fetching additional schemas.\n- Address coverity issues.\n- Address certain clang static analysis errors.\n- libs: Fix cppcheck warnings.\n- libcrmcommon: bump feature set to 3.20.1\n- scheduler: Require a cluster option for old remote fencing behavior.\n- scheduler: Don't always fence online remote nodes.\n- daemons: Convert schedulerd to support multipart IPC messages.\n- daemons: Convert attrd to support multipart IPC messages.\n- daemons: Convert pacemakerd to support multipart IPC messages.\n- daemons: Convert execd to support multipart IPC messages.\n- daemons: Convert fenced to support multipart IPC messages.\n- daemons: Convert controld to support multipart IPC messages.\n- daemons: Convert based to support multipart IPC messages.\n- libcrmcommon: Retry on EAGAIN in crm_ipcs_flush_events.\n- libcrmcommon: All parts of a multipart event should have the same ID\n- libcrmcommon: Don't immediately overwrite request ID.\n- libcrmcommon: Check the client buffer in crm_ipc_buffer.\n- libcrmcommon: Handle sending multi-part IPC server events.\n- libcrmcommon: crm_ipc_read can receive large IPC messages.\n- libcrmcommon: Elements should never match if IDs differ\n- libcrmcommon: Consistently free iov on error.\n- libcrmcommon: Always free temp node in mark_child_deleted()\n- libcrmcommon: Fix XML matching when marking changes\n- fencer: Don't remove device if child is deleted\n- controller: Populate nodes from peer cache if can't from cluster\n- libcib: Don't match element based on XPath matching an attribute\n- tools: Use correct error code for command lookup failure\n- tools: Dry-run crm_resource --fail if CIB_file is set\n- libcrmcommon: Sort schema transformations on non-glibc systems\n- libcrmcommon: Ensure schema transform numbers are in valid range\n- libcrmcommon: Match literal dots in schema transform filter\n- spec: Provides user(hacluster) and group(haclient)\n- libcrmservice: Fix overrides for systemd resources\n- libcrmservice: Fail systemd rsc start if create override fails\n- Build: Run cts-cli verbosely.\n- controller: improve resource action execution logs\n- controller: improve start-up/exit messages\n- controller: drop dot file logs\n- controller: simplify join finalization messages\n- pacemaker-based: improve a few messages\n- pacemaker-based: improve exit messages\n- pacemaker-based: improve messages when reading CIB from disk\n- libpacemaker: Reset scheduler object in pcmk_simulate()\n- libpe_status: Make cluster_status() idempotent\n- tools: Fix overflow in crm_simulate --repeat\n- libpacemaker: Handle scandir() error in pcmk__profile_dir()\n- libpacemaker: Fix mem leak in pcmk__profile_dir()\n- tools: Avoid crash in crm_simulate --profile\n- Makefile: drop asciidoc references\n- crm_diff: Replace variable name\n- Drop deprecated '--sync-call' option from cibadmin\n- Drop deprecated '-l/--local' option from cibadmin in multiple places\n- raise minimum GnuTLS dependency to 3.4.6\n- sysconfig: document when logs may show sensitive info\n- pacemaker-attrd: reduce log spam at shutdown\n- executor: avoid misleading log when cancelling a recurring monitor\n- scheduler: improve restart-needed log\n- scheduler: don't show node capacity for bundle nodes\n- scheduler: clarify no-quorum effects\n- libcrmcommon: improve flag set/clear messages\n- libcrmcommon: improve message for unsupported XPath match\n- libstonithd: improve action re-attempt message\n- libcib: Don't send CRM_OP_REGISTER from cib_remote client\n- tools: mention potential issues with crm_resource --restart\n- tools: indicate crm_resource --interval can take units\n- tools: clarify that crm_mon updates are automatic when interactive\n- agents: Replace the egrep command with the EGREP definition in ping RA\n- libcrmcluster: fix format typos\n- doc: drop Inkscape dependency\n- tools: validate stonith_admin --timeout value\n- libpacemaker: set fail-count to INFINITY for fatal failures\n- libpacemaker: add PCMK__XA_FAILED_START_OFFSET and PCMK__XA_FAILED_STOP_OFFSET\n- tools: Deprecate cibadmin --sync-call\n- OCF: controld.in: Remove gfs_controld command as it's already obsoleted\n- xml: Warn about post-transform behavior changes for ACLs with xpath\n- sysconfig: Document using certificates for remote nodes.\n- sysconfig: Explain permissions needed on TLS-related files.\n- libcrmcluster: restore CPG header size compatibility\n- libcrmcluster: improve messages in pcmk__cpg_message_data()\n- liblrmd: Enable TLS support for Pacemaker Remote clients.\n- daemons: Enable TLS support for Pacemaker Remote nodes.\n- libcrmcommon: Set *tls = NULL in a few more locations.\n- libcib: Enable TLS certs for remote CIB operations.\n- libs: Log if a TLS certificate is close to expiration.\n- libcrmcommon: If the server supports certs, require them...\n- daemons: Set up X509 auth in based if enabled.\n- sysconfig: Add env settings needed for X509 authentication.\n- libcrmcluster: don't assert for CPG decompression error\n- libcrmcluster: avoid redundant log for invalid CPG messages\n- libcrmcluster: initialize from in pcmk__cpg_message_data()\n- scheduler: avoid memory leak in bundles\n- xml: Preserve ACL reference behavior for replaced constraints\n- xml: Ensure ACL permissions are valid after XSL transformations\n- xml: Warn if schema transformation drops remove-after-stop property\n- xml: Warn if schema transformation drops moon phase\n- xml: Info if schema transformation drops empty groups or clones\n- xml: Warn if schema transformation drops colocation/order lifetimes\n- xml: Warn if schema transformation drops can_fail or...\n- xml: Warn if schema transformation drops restart-type meta-attr\n- xml: Warn if schema transformation drops rkt bundles\n- xml: Warn if schema transformation drops nagios/upstart resources\n- log: Allow CIB upgrade messages to start with W, I, D\n- various: clean up library memory at child exit\n- pacemaker-remoted: improve exit codes for schema failures\n- controller: avoid memory leak when updating join phase\n- scheduler: avoid memory leak when freeing node copies\n- libcrmcommon: drop unhelpful trace message\n","modified":"2026-10-21T17:23:12.854235986Z","published":"2026-10-09T11:57:07Z","related":["CVE-2026-10649"],"upstream":["CVE-2026-10649"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624251-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1180966"},{"type":"REPORT","url":"https://bugzilla.suse.com/1249217"},{"type":"REPORT","url":"https://bugzilla.suse.com/1255371"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259345"},{"type":"REPORT","url":"https://bugzilla.suse.com/1265183"},{"type":"REPORT","url":"https://bugzilla.suse.com/1265201"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268381"},{"type":"REPORT","url":"https://bugzilla.suse.com/1270354"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271652"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272452"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279543"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-10649"}],"affected":[{"package":{"name":"pacemaker","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","purl":"pkg:rpm/suse/pacemaker&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3+20260728.7052efa194-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"pacemaker-libs":"3.0.3+20260728.7052efa194-160000.1.1","pacemaker-remote":"3.0.3+20260728.7052efa194-160000.1.1","pacemaker-schemas":"3.0.3+20260728.7052efa194-160000.1.1","python3-pacemaker":"3.0.3+20260728.7052efa194-160000.1.1","pacemaker":"3.0.3+20260728.7052efa194-160000.1.1","pacemaker-cli":"3.0.3+20260728.7052efa194-160000.1.1","pacemaker-cts":"3.0.3+20260728.7052efa194-160000.1.1","pacemaker-devel":"3.0.3+20260728.7052efa194-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24251-1.json"}}],"schema_version":"1.9.0"}