Red Hat Security Advisory

RHSA-2026:11493

pcs security update

Released 2026-04-29 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux High Availability AUS (v.8.4) pcs-0.10.8-1.el8_4.11, pcs-snmp-0.10.8-1.el8_4.11
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) pcs-0.10.8-1.el8_4.11, pcs-snmp-0.10.8-1.el8_4.11

Fixes 2 records

TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names

MEDIUM 48

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02808 Published 2026-03-31 Partial fix · 4.18.1, 4.18.0 CWE-94

TI-2026-24502 CVE-2026-31958 · GHSA-qjxf-f2mg-c6mc

Tornado has a DoS due to too many multipart parts

MEDIUM 44

Tornado is a Python web framework and asynchronous networking library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00417 Published 2026-03-11 Partial fix · 6.5.5 CWE-400