Red Hat Security Advisory

RHSA-2026:11454

pcs security update

Released 2026-04-29 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux High Availability E4S (v.9.0) pcs-0.11.1-10.el9_0.11, pcs-snmp-0.11.1-10.el9_0.11
Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) pcs-0.11.1-10.el9_0.11, pcs-snmp-0.11.1-10.el9_0.11

Fixes 2 records

TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names

MEDIUM 48

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02808 Published 2026-03-31 Partial fix · 4.18.1, 4.18.0 CWE-94

TI-2026-24502 CVE-2026-31958 · GHSA-qjxf-f2mg-c6mc

Tornado has a DoS due to too many multipart parts

MEDIUM 44

Tornado is a Python web framework and asynchronous networking library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00417 Published 2026-03-11 Partial fix · 6.5.5 CWE-400