SUSE-SU-2026:24196-1

This update for pacemaker fixes the following issues:

Security issue fixed:

• CVE-2026-10649: denial of service via integer overflow in remote message decompression (bsc#1268381).

Changes for pacemaker:

Update to version 3.0.3+20260728.7052efa194:

• cts: make cts-scheduler -o/--out-dir default to a temporary directory (bsc#1272452)
• spec: Add symlinks for test support files in the pacemaker-cts sub-package (bsc#1272452)
• cts: Do not install test support files into /usr at runtime (bsc#1272452)
• libcrmcommon: Make pcmk__auto_fencing_watchdog_timeout() static
• libcrmcommon: Functionize parsing "fencing-watchdog-timeout"
• liblrmd: Check watchdog-based self-fencing device for remote nodes only if "fencing-watchdog-timeout" is enabled (bsc#1270354, gh#ClusterLabs/pacemaker#4146)
• controller: Check for watchdog-based self-fencing device only if "fencing-watchdog-timeout" is enabled (bsc#1270354, gh#ClusterLabs/pacemaker#4146)
• fencer: Avoid use-after-free in debug log (bsc#1279543, gh#ClusterLabs/pacemaker#4172)
• fenced: Prevent segfault by not merging with in-flight fencing actions (bsc#1271652, gh#ClusterLabs/pacemaker##4152)
• ChangeLog: update for 3.0.3 release
• Build: update version information for 3.0.3
• libraries: update shared object versions for 3.0.3
• NLS: update translations before 3.0.3-rc1
• cibadmin: allow altering status section without triggering refresh (gh#ClusterLabs/pacemaker#4147)
• tools: Use g_spawn_sync in cibsecret.
• tools: Handle UTF-8 parameters in crm_resource.
• tools: Handle UTF-8 parameters in cibsecret.
• agents: Move pid file management into ClusterMon.in.
• libcib: Remove an unnecessary coverity suppression. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)
• libcrmcommon: Fix an integer overflow in pcmk__remote_send_xml. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)
• libcrmcommon: Limit the max size of a remote message. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)
• libcrmcommon: Fix integer overflow in remote message code. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)
• libcrmcommon: Fix checks in localized_remote_header. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)
• liblrmd: Don't include internal header in lrmd.h
• Low: libcrmcommon, tools: Fix NULL dereference in crm_resource.c
• pacemakerd: Properly find and track all existing sub-daemons (bsc#1265201, gh#ClusterLabs/pacemaker#4115)
• tools: Use the VERSION variable instead of invoking crm_attribute --version (bsc#1265183, gh#ClusterLabs/pacemaker#4114)
• libcib: Handle cib_xpath_address for an XPath query for an attribute (gh#ClusterLabs/pacemaker#4108)
• libcib: Prevent based or cibadmin from crashing when handling an XPath query for an attribute (bsc#1249217, gh#ClusterLabs/pacemaker#4108)
• libcrmcommon: Deprecate PCMK_dh_max_bits.
• libcib: Full-CIB replace op no longer segfaults with cib_xpath
• libpe_status: Avoid leaking a pcmk_resource_t's xml/orig_xml
• Revert "API: libraries: Update version numbers in so names"
• ChangeLog: update for 3.0.2-rc1 release
• tools: Avoid memory leak in crm_resource --clear
• libpacemaker, tools: Avoid mem leak in crm_simulate/pcmk_simulate()
• libcib: Avoid memory leak when processing CIB upgrade
• libpe_status: Use first operations child when expanding template
• libpe_status: Improve no resources message in unpack_template()
• daemons: Only log a message if we're falling back.
• update version information for 3.0.2
• libraries: Update version numbers in so names
• libraries: update shared object versions for 3.0.2
• NLS: update translations before 3.0.2-rc1
• libcrmcommon: Deprecate anonymous authentication.
• libcrmcommon: Deprecate remote-clear-port.
• libcib: Add support for PSK authentication for remote CIB ops.
• daemons: Add support for PSK authentication for remote CIB ops.
• libpacemaker: Fix a memory leak in inject_action.
• tools: Free the list at the end of cli_resource_print_operations.
• tools: Fix memory leaks when printing crm_verify warnings/errors.
• libpe: If pe__clone_default exits early, free the lists.
• libpacemaker: Fix a segfault in order_resource_actions_after.
• libcrmcommon: Properly return errno from pcmk__bare_output_new.
• libpe: Free elements of rsc->priv->ticket_constraints...
• libpacemaker: If process_rsc_history exits early, free the list.
• daemons,libcib: Fix memory leaks in IPC code.
• libservices: Deal with fgets errors in services__get_lsb_metadata.
• libpacemaker: Check that instance is not NULL.
• libcrmcommon: Avoid overflow when negating INT_MIN
• libcrmcommon: Avoid overflow in crm_time_add_months()
• libcib: Explicitly handle receiving a NACK from based.
• libcib: Explicitly handle receiving a NACK from fenced.
• daemons: Don't NACK an invalid remote message.
• libcrmcommon: Don't log on error in pcmk__ipc_send_iov.
• daemons: Don't return a NACK if execd gets an unknown message.
• liblrmd: Explicitly handle receiving a NACK from execd.
• liblrmd: Fix log messages in remote_proxy_cb.
• daemons: Delay creating an xmlNode in handle_register_request.
• libcrmcommon: Ignore empty time spec
• tools: Don't wait on certain "pending" monitor actions. (gh#ClusterLabs/pacemaker#4073)
• libcrmcommon: Create a log file if it doesn't exist.
• fencer: Disable watchdog-based self-fencing if "fencing-watchdog-timeout" is unset (gh#ClusterLabs/pacemaker#4067)
• fencer: Make the deprecated "stonith-watchdog-timeout" option work again (gh#ClusterLabs/pacemaker#4068)
• libcrmcommon: Move deprecatd PCMK_OPT_STONITH_TIMEOUT back to options.h
• pacemakerd: Correctly detect ping requests from sbd (gh#ClusterLabs/pacemaker#4066)
• libcrmcommon: Improve message for qb_log_file_open() fail
• libcrmcommon: Improve pcmk__add_logfile() message for fopen() fail
• libcrmcommon: More specific error for set_logfile_permissions()
• libcrmcommon: Improve validation of PCMK_logfile_mode
• liblrmd: Don't assert if queue_time is < 0.
• based: Don't log specially for PCMK__XA_CIB_UPDATE
• controller: Don't treat patchset-apply errors as OK
• libcrmcommon: xml_apply_patchset doesn't return diff_resync err
• libcib: Don't convert -pcmk_err_diff_resync to pcmk_ok
• libcrmcommon: Handle NULL PCMK_XA_FORMAT and PCMK_XA_DIGEST
• libcib, tools: Empty CIB contains admin_epoch before epoch
• daemons: Fix user/group checking in based.
• libcrmcommon: Fix a glib logging build error.
• libcrmcommon: Don't delete unchanged attributes when applying patch
• libcrmcommon: Fix potential use-after-free and double-free (gh#ClusterLabs/pacemaker#4044)
• executor: Fix the typos in the logs.
• libcrmcommon: Set config warnings on mismatched ACL perm specs
• libcrmcommon: xml_acl_filtered_copy() returns false for NULL source (gh#ClusterLabs/pacemaker#4039)
• libcrmcommon: Make parse_acl_entry() non-recursive
• libcrmcommon: Set config warnings and errors for acl_permission
• libcib: Log correct error message in replace_cib()
• libcib: Fix setting origin attributes in CIB updates (gh#ClusterLabs/pacemaker#4028)
• tools: Drop crm_attribute --inhibit-policy-engine/-i option
• libcrmcommon: Fix memory leak in pcmk__read_series_sequence() (gh#ClusterLabs/pacemaker#4032)
• liblrmd: Check that pcmk__init_tls doesn't set native->tls to NULL.
• tools: Drop crm_attribute --attr-value/--delete-attr options
• tools: Drop crm_attribute --attr-id option
• based: Drop unhelpful trace messages
• based: Improve a log message for IPC call options
• libcib: {add,del}_notify_callback support only cib_diff_notify
• based: Return correct code from write_cib_async()
• daemons: Use crm_ipc_client_response in lrmd_remote_client_msg.
• daemons: Set ipc_flags in lrmd_remote_client_msg to 0.
• daemons: Clean up XML memory in IPC dispatch functions.
• daemons: Fix a segfault displaying fencer metadata.
• based: Drop redundant messages from based_diff_notify()
• build: Handle CMocka deprecations
• various: Always NULL-check return value of pcmk__find_client()
• libcrmcommon: Improve messages in child_kill_helper()
• tools: Free memory in crm_resource.c:handle_metadata()
• pacemakerd: Use g_str_has_prefix() in handle_ping_request()
• libpacemaker: Correctly check node types in pcmk__list_nodes()
• pacemakerd: Match correctly in PCMK_{valgrind,callgrind}_enabled
• libcrmcommon: Match correctly in PCMK_debug, stderr, blackbox
• spec: Requires libxml2-tools since DLM controld RA requires xmllint (bsc#1259345)
• daemons: Fix a typo if no existing attrd is found.
• daemons: Call pcmk_cluster_disconnect at the end of fenced.
• libcrmcommon: Fix underflow in crm_time_add_days()
• libcrmcommon: Avoid integer overflow in seconds_to_hms()
• spec: do not treat fillup templates as configuration files
• build: install the default logrotate config into /usr/etc/logrotate.d
• build: create directories in /var via tmpfiles.d
• build: create hacluster user and haclient group via sysusers.d
• agents: Deprecate allow_stonith_disabled param for controld RA
• agents: New allow_fencing_disabled param for controld RA
• agents: Use case-insensitive property matching in controld RA
• schemas: Deprecate stonith-timeout-ms in crm_mon output
• schemas: Deprecate stonith-enabled in crm_mon output
• various: New fencing-timeout-ms in crm_mon/pcmk_status output
• schemas: New fencing-timeout-ms attribute in crm_mon schema
• various: New fencing-enabled in crm_mon/pcmk_status output
• schemas: New fencing-enabled attribute in crm_mon schema
• tools: cibadmin --xpath --delete-all deletes all matches again
• various: Use const for a few string pointer variables
• cts: Respect cts-lab --nic option if specified for IPv4 (gh#ClusterLabs/pacemaker#3986)
• cts: cts-lab --nic option defaults to eth0 only for an IPv6 link local address (gh#ClusterLabs/pacemaker#3986)
• controller: Ask attribute manager to purge fenced nodes' attributes
• controller: Don't purge transient attributes on node loss (gh#ClusterLabs/pacemaker#3991)
• controller: Allow purging node attrs without cache removal
• controller: don't need to erase node attributes for remote nodes
• pacemaker-attrd: Drop "requesting shutdown" code
• pacemaker-attrd: Wipe CIB along with memory (gh#ClusterLabs/pacemaker#3991)
• libcrmservice: Correctly check the return value of stat.
• fencer: Improve validation of pcmk_host_map
• fencer: Drop support for escaped characters in pcmk_host_map
• fencer: Drop unhelpful message from build_port_aliases()
• fencer: Fix ISO 8601 interval parsing in pcmk_delay_base
• daemons: When checking for duplicate messages, we might be prepending.
• daemons: Don't add repeated I_PE_CALC messages to the fsa queue.
• scheduler: promoted state with promoted state with attribute
• fencer: Log an error for empty pcmk_delay_base mapping key
• fencer: Fix a format string
• libcrmservice: List only the requested directory contents
• build, libcrmservice: initdir must be a single directory
• libcrmservice: Fix memory leaks when listing directory contents
• cts: Add cts-lab --nic option used for generated IP address resources (gh#ClusterLabs/pacemaker#3982)
• libcrmcommon: Loop on EAGAIN in mainloop_gio_callback.
• daemons: Get rid of some logged warnings in execd.
• libcrmcommon: Bump feature set to 3.20.5
• libcrmcommon: Deprecate stop-removed-resources cluster property
• libcrmcommon: Deprecate cancel-removed-actions cluster property
• libpe_status: Warn if concurrent-fencing is false
• libcrmcommon: Deprecate enable-startup-probes cluster property
• libcrmcommon: Rename stop-removed-actions to cancel-removed-actions
• libcrmcommon: Deprecate cluster-ipc-limit cluster option
• cts-cli: Escape special characters in the path for a pattern (gh#ClusterLabs/pacemaker#3971)
• tools: Handle large timeouts correctly in crm_resource --wait
• controller: NULL-check lrm_state before dereferencing it
• tools: cibsecret should work with CIB_file set.
• controller: Avoid "stonith" in log messages
• tools: Use "fencing" in stonith_admin/crm_resource
• libpe_status: Use "fencing" instead of "STONITH" in some logs
• libcrmcommon: New "fencing-reaction" cluster property
• libcrmcommon: New "fencing-watchdog-timeout" cluster property
• libcrmcommon: New "fencing-timeout" cluster property
• libcrmcommon: New "fencing-max-attempts" cluster property
• libcrmcommon: New "fencing-action" cluster property
• libcrmcommon: New "fencing-enabled" cluster property
• libcrmcommon: Update documentation for cluster-ipc-limit.
• libcrmcommon: Be more lenient in evicting IPC clients.
• tools: Deprecate iso8601 command line tool
• libcrmcommon: Show deprecated option aliases in outputs
• libcrmcommon: Parse iso8601 strings according to spec.
• fencer: Prevent unsigned int overflow in get_action_timeout()
• libcrmcommon: Fix integer overflow of alert timeouts
• libcrmcommon: Ensure stonith watchdog timeout is in long range
• controller, fencer: Ignore negative/unparsable pcmk_monitor_timeout
• cts: Drop cts script
• tools: Drop crm_report -T/--cts and --cts-log options
• schemas: Deprecate "orphaned" attribute
• schemas: resource XML element has new "removed" attribute
• schemas: Deprecate "orphan" attribute in crm_mon and crm_simulate
• schemas: resource_history XML element has new "removed" attribute
• libcrmcommon: Fix a segfault in internal_ipc_get_reply. (bsc#1255371, gh#ClusterLabs/pacemaker#3949)
• libcrmcommon: New "stop-removed-resources" cluster property
• libcrmcommon: New "stop-removed-actions" cluster property
• sysconfig: Remove --leak-check=full from default VALGRIND_OPTS.
• tools: Hide crm_mon --as-xml option
• crm_mon: Deprecate --pid-file/-p option
• tools: Fix CIB validation in crm_mon.c
• libcib, libcrmcommon: Improve a couple of log messages
• libcrmcommon: pcmk__quote_cmdline() returns valid shell string
• libcrmcommon: Bump feature set to 3.20.4
• schemas: Add a schema for cibadmin
• tools: Use formatted output in cibadmin
• tools: Formatted output for cibadmin --show-access --query
• tools: Formatted output for cibadmin --node-path
• tools: Basic cibadmin XML formatted output
• tools: Formatted output for cibadmin --empty
• tools: Formatted output for cibadmin --md5-sum{,-versioned}
• tools: Deprecate cibadmin -e/--node-path option
• libcrmcommon: bump feature set to 3.20.3
• schemas: Add a schema for cibsecret.
• libcrmcommon: Return a value for md5sum of empty input.
• tools: Remove the shell version of cibsecret.
• tools: Improve some cibadmin error messages
• tools: cibadmin renders ACLs only when output is cib element
• tools: cibadmin now errors if unable to compute md5 sum
• libcib, tools: Resolve cibadmin TODO re: ACL rendering and input
• controller: Avoid crash due to GSource double-free
• tools: Deprecate cibadmin -N/--node option
• tools: Drop "Digest: " from cibadmin --md5-sum stderr
• tools: cibadmin ignores --node-path for non-XPath-query command
• tools: Change exit codes for failure to create cib_t object
• libcib: Fix cib__signon_retry() return code
• tools: Deprecate cibadmin --show-access as non-privileged user
• tools: Don't require --force for non-privileged cibadmin ACLs
• tools: Default cibadmin command is now --query
• tools: Deprecate current input source precedence in cibadmin
• tools: Drop cibadmin --extended-version/-! option
• libcrmcommon: Bump feature set to 3.20.2
• schemas: Add a schema for crm_diff
• tools: Use formatted output in crm_diff.c
• libcrmcommon: Standardize remote environment variable parsing
• libcrmcommon: Allow empty string values in pcmk__scan_nvpair()
• libcrmcommon: Keep trailing newlines in pcmk__scan_nvpair()
• fencer: Fix fence delay range off-by-one
• daemons: Return CRM_EX_PROTOCOL when ACKing an unknown request.
• daemons: Correct result error string on unknown IPC messages.
• daemons: Add a return to do_pe_invoke_callback.
• tools: Deprecate crm_diff --stdin
• tools: Improve error handling in crm_diff.c
• tools: Be stricter about crm_diff --cib/--no-version
• libcrmcommon: Don't require version info when applying CIB patches
• agents: Error check calling attrd_updater in HealthSMART.
• agents: Error check calling attrd_updater in HealthIOWait.
• agents: Error out if CPU I/O wait time isn't available.
• agents: Error check calling attrd_updater in HealthCPU.
• agents: Error out if CPU idleness isn't available.
• daemons: Don't log the unresponsive message for a daemon we killed
• controller: Avoid blocking wait in controller for CIB re-request
• cts: Remove --valgrind-tests
• cts: Leave valgrind results around if they're not empty.
• NLS: update translations before 3.0.1-rc1
• libpacemaker: Prevent CIB growth during crm_simulate --profile
• daemons: Fix a toctou bug when fetching additional schemas.
• Address coverity issues.
• Address certain clang static analysis errors.
• libs: Fix cppcheck warnings.
• libcrmcommon: bump feature set to 3.20.1
• scheduler: Require a cluster option for old remote fencing behavior.
• scheduler: Don't always fence online remote nodes.
• daemons: Convert schedulerd to support multipart IPC messages.
• daemons: Convert attrd to support multipart IPC messages.
• daemons: Convert pacemakerd to support multipart IPC messages.
• daemons: Convert execd to support multipart IPC messages.
• daemons: Convert fenced to support multipart IPC messages.
• daemons: Convert controld to support multipart IPC messages.
• daemons: Convert based to support multipart IPC messages.
• libcrmcommon: Retry on EAGAIN in crm_ipcs_flush_events.
• libcrmcommon: All parts of a multipart event should have the same ID
• libcrmcommon: Don't immediately overwrite request ID.
• libcrmcommon: Check the client buffer in crm_ipc_buffer.
• libcrmcommon: Handle sending multi-part IPC server events.
• libcrmcommon: crm_ipc_read can receive large IPC messages.
• libcrmcommon: Elements should never match if IDs differ
• libcrmcommon: Consistently free iov on error.
• libcrmcommon: Always free temp node in mark_child_deleted()
• libcrmcommon: Fix XML matching when marking changes
• fencer: Don't remove device if child is deleted
• controller: Populate nodes from peer cache if can't from cluster
• libcib: Don't match element based on XPath matching an attribute
• tools: Use correct error code for command lookup failure
• tools: Dry-run crm_resource --fail if CIB_file is set
• libcrmcommon: Sort schema transformations on non-glibc systems
• libcrmcommon: Ensure schema transform numbers are in valid range
• libcrmcommon: Match literal dots in schema transform filter
• spec: Provides user(hacluster) and group(haclient)
• libcrmservice: Fix overrides for systemd resources
• libcrmservice: Fail systemd rsc start if create override fails
• Build: Run cts-cli verbosely.
• controller: improve resource action execution logs
• controller: improve start-up/exit messages
• controller: drop dot file logs
• controller: simplify join finalization messages
• pacemaker-based: improve a few messages
• pacemaker-based: improve exit messages
• pacemaker-based: improve messages when reading CIB from disk
• libpacemaker: Reset scheduler object in pcmk_simulate()
• libpe_status: Make cluster_status() idempotent
• tools: Fix overflow in crm_simulate --repeat
• libpacemaker: Handle scandir() error in pcmk__profile_dir()
• libpacemaker: Fix mem leak in pcmk__profile_dir()
• tools: Avoid crash in crm_simulate --profile
• Makefile: drop asciidoc references
• crm_diff: Replace variable name
• Drop deprecated '--sync-call' option from cibadmin
• Drop deprecated '-l/--local' option from cibadmin in multiple places
• raise minimum GnuTLS dependency to 3.4.6
• sysconfig: document when logs may show sensitive info
• pacemaker-attrd: reduce log spam at shutdown
• executor: avoid misleading log when cancelling a recurring monitor
• scheduler: improve restart-needed log
• scheduler: don't show node capacity for bundle nodes
• scheduler: clarify no-quorum effects
• libcrmcommon: improve flag set/clear messages
• libcrmcommon: improve message for unsupported XPath match
• libstonithd: improve action re-attempt message
• libcib: Don't send CRM_OP_REGISTER from cib_remote client
• tools: mention potential issues with crm_resource --restart
• tools: indicate crm_resource --interval can take units
• tools: clarify that crm_mon updates are automatic when interactive
• agents: Replace the egrep command with the EGREP definition in ping RA
• libcrmcluster: fix format typos
• doc: drop Inkscape dependency
• tools: validate stonith_admin --timeout value
• libpacemaker: set fail-count to INFINITY for fatal failures
• libpacemaker: add PCMK__XA_FAILED_START_OFFSET and PCMK__XA_FAILED_STOP_OFFSET
• tools: Deprecate cibadmin --sync-call
• OCF: controld.in: Remove gfs_controld command as it's already obsoleted
• xml: Warn about post-transform behavior changes for ACLs with xpath
• sysconfig: Document using certificates for remote nodes.
• sysconfig: Explain permissions needed on TLS-related files.
• libcrmcluster: restore CPG header size compatibility
• libcrmcluster: improve messages in pcmk__cpg_message_data()
• liblrmd: Enable TLS support for Pacemaker Remote clients.
• daemons: Enable TLS support for Pacemaker Remote nodes.
• libcrmcommon: Set *tls = NULL in a few more locations.
• libcib: Enable TLS certs for remote CIB operations.
• libs: Log if a TLS certificate is close to expiration.
• libcrmcommon: If the server supports certs, require them...
• daemons: Set up X509 auth in based if enabled.
• sysconfig: Add env settings needed for X509 authentication.
• libcrmcluster: don't assert for CPG decompression error
• libcrmcluster: avoid redundant log for invalid CPG messages
• libcrmcluster: initialize from in pcmk__cpg_message_data()
• scheduler: avoid memory leak in bundles
• xml: Preserve ACL reference behavior for replaced constraints
• xml: Ensure ACL permissions are valid after XSL transformations
• xml: Warn if schema transformation drops remove-after-stop property
• xml: Warn if schema transformation drops moon phase
• xml: Info if schema transformation drops empty groups or clones
• xml: Warn if schema transformation drops colocation/order lifetimes
• xml: Warn if schema transformation drops can_fail or...
• xml: Warn if schema transformation drops restart-type meta-attr
• xml: Warn if schema transformation drops rkt bundles
• xml: Warn if schema transformation drops nagios/upstart resources
• log: Allow CIB upgrade messages to start with W, I, D
• various: clean up library memory at child exit
• pacemaker-remoted: improve exit codes for schema failures
• controller: avoid memory leak when updating join phase
• scheduler: avoid memory leak when freeing node copies
• libcrmcommon: drop unhelpful trace message