CLSA-2026-1790243751
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1790243751.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1790243751
- Upstream
- Published
- 2026-09-24T09:56:11Z
- Modified
- 2026-10-26T09:43:44Z
- Summary
- pcs: Fix of 10 CVEs
- Details
-
- CVE-2025-46727: unbounded query parsing in bundled rack; a body of repeated keys was parsed in full, exhausting memory. Capped by rack's new query bytesize and parameter-count limits, which pcsd turns into an HTTP 400
- CVE-2025-59830: the same unbounded query parse reached through ';' separated query strings, which rack's parameter counter did not count
- CVE-2025-61770: multipart parsing in bundled rack read the whole request body searching for a boundary that never arrived
- CVE-2025-61771: multipart parsing in bundled rack retained an unbounded non-file field in memory
- CVE-2025-61772: multipart mime part headers in bundled rack were read with no size limit
- CVE-2025-61919: Rack::Request#POST read the entire request body before any limit applied, so a 64 MB body was fully buffered
- CVE-2024-49761: quadratic regular expression in bundled rexml BaseParser#unnormalize; a long run of zeros in a hex character reference made the parser hang
- CVE-2024-52804: quadratic cookie unquoting in bundled tornado _unquote_cookie, which rescanned the value from each escape
- CVE-2025-47287: malformed multipart/form-data in bundled tornado logged a warning per bad part instead of rejecting the request, flooding the log
- CVE-2026-31958: unbounded part count and part header size in bundled tornado multipart parsing
- Stop forwarding client HTTP headers from the Tornado front end to the Ruby part of pcsd, which only ever needed the cookie and the content type
- References
-
- https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1790243751.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-49761
- https://nvd.nist.gov/vuln/detail/CVE-2024-52804
- https://nvd.nist.gov/vuln/detail/CVE-2025-46727
- https://nvd.nist.gov/vuln/detail/CVE-2025-47287
- https://nvd.nist.gov/vuln/detail/CVE-2025-59830
- https://nvd.nist.gov/vuln/detail/CVE-2025-61770
- https://nvd.nist.gov/vuln/detail/CVE-2025-61771
- https://nvd.nist.gov/vuln/detail/CVE-2025-61772
- https://nvd.nist.gov/vuln/detail/CVE-2025-61919
- https://nvd.nist.gov/vuln/detail/CVE-2026-31958
Affected packages
TuxCare:CentOS-Stream:8 / pcs
Package
- Name
- pcs
- Purl
- pkg:rpm/tuxcare/pcs?distro=centos-stream-8