Red Hat Security Advisory

RHSA-2026:84844

pcs security update

Released 2026-10-19 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux High Availability E4S (v.8.8) pcs-0.10.15-4.el8_8.12, pcs-snmp-0.10.15-4.el8_8.12
Red Hat Enterprise Linux High Availability TUS (v.8.8) pcs-0.10.15-4.el8_8.12, pcs-snmp-0.10.15-4.el8_8.12

Fixes 2 records

TI-2024-13023 CVE-2024-14029 · GHSA-hr42-gv84-2f3g

Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

HIGH 72

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request.

CVSS 4.0CRITICAL 9.0 Network No auth No interaction EPSS 0.00361 Published 2026-09-15 Partial fix · 6.4.1 CWE-444

TI-2026-56814 CVE-2026-82397 · GHSA-mpf4-983q-p7j4

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

LOW 39

Tornado is a Python web framework and asynchronous networking library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00346 Published 2026-08-31 Partial fix · 6.5.8 CWE-1284