pcs (AlmaLinux:8) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the AlmaLinux:8 package pcs, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (28)

• CVE-2022-45442 — CVSS 8.8 (high): Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0…
• CVE-2022-1049 — CVSS 8.8 (high): A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired…
• CVE-2022-2735 — CVSS 7.8 (high): A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal…
• CVE-2023-27530 — CVSS 7.5 (high): A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could…
• CVE-2025-67726 — CVSS 7.5 (high): Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing…
• CVE-2025-67725 — CVSS 7.5 (high): Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP…
• CVE-2025-61919 — CVSS 7.5 (high): Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request…
• CVE-2025-61772 — CVSS 7.5 (high): Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate…
• CVE-2025-61771 — CVSS 7.5 (high): Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parser` stores non-file…
• CVE-2025-61770 — CVSS 7.5 (high): Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire…
• CVE-2025-59830 — CVSS 7.5 (high): Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters…
• CVE-2025-47287 — CVSS 7.5 (high): Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain…
• CVE-2025-46727 — CVSS 7.5 (high): Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and…
• CVE-2024-52804 — CVSS 7.5 (high): Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions…
• CVE-2024-49761 — CVSS 7.5 (high): REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between…
• CVE-2026-31958 — CVSS 7.5 (high): Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number…
• CVE-2022-29970 — CVSS 7.5 (high): Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
• CVE-2020-11023 — CVSS 6.9 (medium) — actively exploited: In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even…
• CVE-2020-7656 — CVSS 6.1 (medium): jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>"…
• CVE-2024-43398 — CVSS 5.9 (medium): REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that…
• CVE-2024-26141 — CVSS 5.8 (medium): Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large…
• CVE-2024-21510 — CVSS 5.4 (medium): Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host…
• CVE-2024-26146 — CVSS 5.3 (medium): Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected…
• CVE-2024-25126 — CVSS 5.3 (medium): Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much…
• CVE-2023-27539 — CVSS 5.3 (medium): There is a denial of service vulnerability in the header parsing component of Rack.
• CVE-2024-41123 — CVSS 5.3 (medium): REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific…
• CVE-2024-41946 — CVSS 5.3 (medium): REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with…
• CVE-2024-35176 — CVSS 5.3 (medium): REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s…