FlawAtlas
Search the atlas
ALSA-2026:1240 Not scored

Important: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418) * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Exploit probability Not scored
Published January 26, 2026
Required by Not available
Last source change April 17, 2026

02 / AFFECTED SOFTWARE

Affected packages

AlmaLinux:8 fence-agents-ifmib
AlmaLinux:8 fence-agents-gce
AlmaLinux:8 fence-agents-vmware-soap
AlmaLinux:8 fence-agents-eaton-snmp
AlmaLinux:8 fence-agents-ipdu
AlmaLinux:8 fence-agents-eps
AlmaLinux:8 fence-agents-ipmilan
AlmaLinux:8 fence-agents-ilo-ssh
AlmaLinux:8 fence-agents-cisco-ucs
AlmaLinux:8 fence-agents-zvm
AlmaLinux:8 fence-agents-all
AlmaLinux:8 fence-agents-aws
AlmaLinux:8 fence-agents-bladecenter
AlmaLinux:8 fence-agents-intelmodular
AlmaLinux:8 fence-agents-ilo2
AlmaLinux:8 fence-agents-scsi
AlmaLinux:8 fence-agents-ibm-vpc
AlmaLinux:8 fence-agents-compute
AlmaLinux:8 fence-agents-rsa
AlmaLinux:8 fence-agents-emerson
AlmaLinux:8 fence-agents-lpar
AlmaLinux:8 fence-agents-rsb
AlmaLinux:8 fence-agents-cisco-mds
AlmaLinux:8 fence-agents-ibmblade
AlmaLinux:8 fence-agents-kubevirt
AlmaLinux:8 fence-agents-apc-snmp
AlmaLinux:8 fence-agents-ilo-mp
AlmaLinux:8 fence-agents-openstack
AlmaLinux:8 fence-agents-drac5
AlmaLinux:8 fence-agents-ilo-moonshot
AlmaLinux:8 fence-agents-aliyun
AlmaLinux:8 fence-agents-virsh
AlmaLinux:8 fence-agents-common
AlmaLinux:8 fence-agents-ibm-powervs
AlmaLinux:8 fence-agents-brocade
AlmaLinux:8 fence-agents-redfish
AlmaLinux:8 fence-agents-vmware-rest
AlmaLinux:8 fence-agents-heuristics-ping
AlmaLinux:8 fence-agents-hpblade
AlmaLinux:8 fence-agents-apc
AlmaLinux:8 fence-agents-rhevm
AlmaLinux:8 fence-agents-sbd
AlmaLinux:8 fence-agents-kdump
AlmaLinux:8 fence-agents-azure-arm
AlmaLinux:8 fence-agents-mpath
AlmaLinux:8 fence-agents-wti
AlmaLinux:8 fence-agents-nutanix-ahv
AlmaLinux:8 fence-agents-amt-ws

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities ALSA-2026:1240

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418) * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

View original source

05 / REFERENCES

Further evidence