<div class="container">
<h1>Security update for pacemaker</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:24251-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-10-09T11:53:26Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1180966">bsc#1180966</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1249217">bsc#1249217</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1255371">bsc#1255371</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259345">bsc#1259345</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265183">bsc#1265183</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265201">bsc#1265201</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268381">bsc#1268381</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1270354">bsc#1270354</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271652">bsc#1271652</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272452">bsc#1272452</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1279543">bsc#1279543</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-10649.html">CVE-2026-10649</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-10649</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-10649</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.6</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-10649</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.6</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Server for SAP applications 16.0</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves one vulnerability and has 10 fixes can now be installed.</p>
<h2>Description:</h2>
<p>This update for pacemaker fixes the following issues:</p>
<p>Security issue fixed:</p>
<ul>
<li>CVE-2026-10649: denial of service via integer overflow in remote message decompression (bsc#1268381).</li>
</ul>
<p>Changes for pacemaker:</p>
<p>Update to version 3.0.3+20260728.7052efa194:</p>
<ul>
<li>cts: make cts-scheduler -o/--out-dir default to a temporary directory (bsc#1272452)</li>
<li>spec: Add symlinks for test support files in the pacemaker-cts sub-package (bsc#1272452)</li>
<li>cts: Do not install test support files into /usr at runtime (bsc#1272452)</li>
<li>libcrmcommon: Make pcmk__auto_fencing_watchdog_timeout() static</li>
<li>libcrmcommon: Functionize parsing "fencing-watchdog-timeout"</li>
<li>liblrmd: Check watchdog-based self-fencing device for remote nodes only if "fencing-watchdog-timeout" is enabled (bsc#1270354, gh#ClusterLabs/pacemaker#4146)</li>
<li>controller: Check for watchdog-based self-fencing device only if "fencing-watchdog-timeout" is enabled (bsc#1270354, gh#ClusterLabs/pacemaker#4146)</li>
<li>fencer: Avoid use-after-free in debug log (bsc#1279543, gh#ClusterLabs/pacemaker#4172)</li>
<li>fenced: Prevent segfault by not merging with in-flight fencing actions (bsc#1271652, gh#ClusterLabs/pacemaker##4152)</li>
<li>ChangeLog: update for 3.0.3 release</li>
<li>Build: update version information for 3.0.3</li>
<li>libraries: update shared object versions for 3.0.3</li>
<li>NLS: update translations before 3.0.3-rc1</li>
<li>cibadmin: allow altering status section without triggering refresh (gh#ClusterLabs/pacemaker#4147)</li>
<li>tools: Use g_spawn_sync in cibsecret.</li>
<li>tools: Handle UTF-8 parameters in crm_resource.</li>
<li>tools: Handle UTF-8 parameters in cibsecret.</li>
<li>agents: Move pid file management into ClusterMon.in.</li>
<li>libcib: Remove an unnecessary coverity suppression. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)</li>
<li>libcrmcommon: Fix an integer overflow in pcmk__remote_send_xml. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)</li>
<li>libcrmcommon: Limit the max size of a remote message. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)</li>
<li>libcrmcommon: Fix integer overflow in remote message code. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)</li>
<li>libcrmcommon: Fix checks in localized_remote_header. (CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)</li>
<li>liblrmd: Don't include internal header in lrmd.h</li>
<li>Low: libcrmcommon, tools: Fix NULL dereference in crm_resource.c</li>
<li>pacemakerd: Properly find and track all existing sub-daemons (bsc#1265201, gh#ClusterLabs/pacemaker#4115)</li>
<li>tools: Use the VERSION variable instead of invoking <code>crm_attribute --version</code> (bsc#1265183, gh#ClusterLabs/pacemaker#4114)</li>
<li>libcib: Handle cib_xpath_address for an XPath query for an attribute (gh#ClusterLabs/pacemaker#4108)</li>
<li>libcib: Prevent based or cibadmin from crashing when handling an XPath query for an attribute (bsc#1249217, gh#ClusterLabs/pacemaker#4108)</li>
<li>libcrmcommon: Deprecate PCMK_dh_max_bits.</li>
<li>libcib: Full-CIB replace op no longer segfaults with cib_xpath</li>
<li>libpe_status: Avoid leaking a pcmk_resource_t's xml/orig_xml</li>
<li>Revert "API: libraries: Update version numbers in so names"</li>
<li>ChangeLog: update for 3.0.2-rc1 release</li>
<li>tools: Avoid memory leak in crm_resource --clear</li>
<li>libpacemaker, tools: Avoid mem leak in crm_simulate/pcmk_simulate()</li>
<li>libcib: Avoid memory leak when processing CIB upgrade</li>
<li>libpe_status: Use first operations child when expanding template</li>
<li>libpe_status: Improve no resources message in unpack_template()</li>
<li>daemons: Only log a message if we're falling back.</li>
<li>update version information for 3.0.2</li>
<li>libraries: Update version numbers in so names</li>
<li>libraries: update shared object versions for 3.0.2</li>
<li>NLS: update translations before 3.0.2-rc1</li>
<li>libcrmcommon: Deprecate anonymous authentication.</li>
<li>libcrmcommon: Deprecate remote-clear-port.</li>
<li>libcib: Add support for PSK authentication for remote CIB ops.</li>
<li>daemons: Add support for PSK authentication for remote CIB ops.</li>
<li>libpacemaker: Fix a memory leak in inject_action.</li>
<li>tools: Free the list at the end of cli_resource_print_operations.</li>
<li>tools: Fix memory leaks when printing crm_verify warnings/errors.</li>
<li>libpe: If pe__clone_default exits early, free the lists.</li>
<li>libpacemaker: Fix a segfault in order_resource_actions_after.</li>
<li>libcrmcommon: Properly return errno from pcmk__bare_output_new.</li>
<li>libpe: Free elements of rsc->priv->ticket_constraints...</li>
<li>libpacemaker: If process_rsc_history exits early, free the list.</li>
<li>daemons,libcib: Fix memory leaks in IPC code.</li>
<li>libservices: Deal with fgets errors in services__get_lsb_metadata.</li>
<li>libpacemaker: Check that instance is not NULL.</li>
<li>libcrmcommon: Avoid overflow when negating INT_MIN</li>
<li>libcrmcommon: Avoid overflow in crm_time_add_months()</li>
<li>libcib: Explicitly handle receiving a NACK from based.</li>
<li>libcib: Explicitly handle receiving a NACK from fenced.</li>
<li>daemons: Don't NACK an invalid remote message.</li>
<li>libcrmcommon: Don't log on error in pcmk__ipc_send_iov.</li>
<li>daemons: Don't return a NACK if execd gets an unknown message.</li>
<li>liblrmd: Explicitly handle receiving a NACK from execd.</li>
<li>liblrmd: Fix log messages in remote_proxy_cb.</li>
<li>daemons: Delay creating an xmlNode in handle_register_request.</li>
<li>libcrmcommon: Ignore empty time spec</li>
<li>tools: Don't wait on certain "pending" monitor actions. (gh#ClusterLabs/pacemaker#4073)</li>
<li>libcrmcommon: Create a log file if it doesn't exist.</li>
<li>fencer: Disable watchdog-based self-fencing if "fencing-watchdog-timeout" is unset (gh#ClusterLabs/pacemaker#4067)</li>
<li>fencer: Make the deprecated "stonith-watchdog-timeout" option work again (gh#ClusterLabs/pacemaker#4068)</li>
<li>libcrmcommon: Move deprecatd PCMK_OPT_STONITH_TIMEOUT back to options.h</li>
<li>pacemakerd: Correctly detect ping requests from sbd (gh#ClusterLabs/pacemaker#4066)</li>
<li>libcrmcommon: Improve message for qb_log_file_open() fail</li>
<li>libcrmcommon: Improve pcmk__add_logfile() message for fopen() fail</li>
<li>libcrmcommon: More specific error for set_logfile_permissions()</li>
<li>libcrmcommon: Improve validation of PCMK_logfile_mode</li>
<li>liblrmd: Don't assert if queue_time is < 0.</li>
<li>based: Don't log specially for PCMK__XA_CIB_UPDATE</li>
<li>controller: Don't treat patchset-apply errors as OK</li>
<li>libcrmcommon: xml_apply_patchset doesn't return diff_resync err</li>
<li>libcib: Don't convert -pcmk_err_diff_resync to pcmk_ok</li>
<li>libcrmcommon: Handle NULL PCMK_XA_FORMAT and PCMK_XA_DIGEST</li>
<li>libcib, tools: Empty CIB contains admin_epoch before epoch</li>
<li>daemons: Fix user/group checking in based.</li>
<li>libcrmcommon: Fix a glib logging build error.</li>
<li>libcrmcommon: Don't delete unchanged attributes when applying patch</li>
<li>libcrmcommon: Fix potential use-after-free and double-free (gh#ClusterLabs/pacemaker#4044)</li>
<li>executor: Fix the typos in the logs.</li>
<li>libcrmcommon: Set config warnings on mismatched ACL perm specs</li>
<li>libcrmcommon: xml_acl_filtered_copy() returns false for NULL source (gh#ClusterLabs/pacemaker#4039)</li>
<li>libcrmcommon: Make parse_acl_entry() non-recursive</li>
<li>libcrmcommon: Set config warnings and errors for acl_permission</li>
<li>libcib: Log correct error message in replace_cib()</li>
<li>libcib: Fix setting origin attributes in CIB updates (gh#ClusterLabs/pacemaker#4028)</li>
<li>tools: Drop crm_attribute --inhibit-policy-engine/-i option</li>
<li>libcrmcommon: Fix memory leak in pcmk__read_series_sequence() (gh#ClusterLabs/pacemaker#4032)</li>
<li>liblrmd: Check that pcmk__init_tls doesn't set native->tls to NULL.</li>
<li>tools: Drop crm_attribute --attr-value/--delete-attr options</li>
<li>tools: Drop crm_attribute --attr-id option</li>
<li>based: Drop unhelpful trace messages</li>
<li>based: Improve a log message for IPC call options</li>
<li>libcib: {add,del}_notify_callback support only cib_diff_notify</li>
<li>based: Return correct code from write_cib_async()</li>
<li>daemons: Use crm_ipc_client_response in lrmd_remote_client_msg.</li>
<li>daemons: Set ipc_flags in lrmd_remote_client_msg to 0.</li>
<li>daemons: Clean up XML memory in IPC dispatch functions.</li>
<li>daemons: Fix a segfault displaying fencer metadata.</li>
<li>based: Drop redundant messages from based_diff_notify()</li>
<li>build: Handle CMocka deprecations</li>
<li>various: Always NULL-check return value of pcmk__find_client()</li>
<li>libcrmcommon: Improve messages in child_kill_helper()</li>
<li>tools: Free memory in crm_resource.c:handle_metadata()</li>
<li>pacemakerd: Use g_str_has_prefix() in handle_ping_request()</li>
<li>libpacemaker: Correctly check node types in pcmk__list_nodes()</li>
<li>pacemakerd: Match correctly in PCMK_{valgrind,callgrind}_enabled</li>
<li>libcrmcommon: Match correctly in PCMK_debug, stderr, blackbox</li>
<li>spec: Requires libxml2-tools since DLM controld RA requires xmllint (bsc#1259345)</li>
<li>daemons: Fix a typo if no existing attrd is found.</li>
<li>daemons: Call pcmk_cluster_disconnect at the end of fenced.</li>
<li>libcrmcommon: Fix underflow in crm_time_add_days()</li>
<li>libcrmcommon: Avoid integer overflow in seconds_to_hms()</li>
<li>spec: do not treat fillup templates as configuration files</li>
<li>build: install the default logrotate config into /usr/etc/logrotate.d</li>
<li>build: create directories in /var via tmpfiles.d</li>
<li>build: create hacluster user and haclient group via sysusers.d</li>
<li>agents: Deprecate allow_stonith_disabled param for controld RA</li>
<li>agents: New allow_fencing_disabled param for controld RA</li>
<li>agents: Use case-insensitive property matching in controld RA</li>
<li>schemas: Deprecate stonith-timeout-ms in crm_mon output</li>
<li>schemas: Deprecate stonith-enabled in crm_mon output</li>
<li>various: New fencing-timeout-ms in crm_mon/pcmk_status output</li>
<li>schemas: New fencing-timeout-ms attribute in crm_mon schema</li>
<li>various: New fencing-enabled in crm_mon/pcmk_status output</li>
<li>schemas: New fencing-enabled attribute in crm_mon schema</li>
<li>tools: cibadmin --xpath --delete-all deletes all matches again</li>
<li>various: Use const for a few string pointer variables</li>
<li>cts: Respect cts-lab --nic option if specified for IPv4 (gh#ClusterLabs/pacemaker#3986)</li>
<li>cts: cts-lab --nic option defaults to eth0 only for an IPv6 link local address (gh#ClusterLabs/pacemaker#3986)</li>
<li>controller: Ask attribute manager to purge fenced nodes' attributes</li>
<li>controller: Don't purge transient attributes on node loss (gh#ClusterLabs/pacemaker#3991)</li>
<li>controller: Allow purging node attrs without cache removal</li>
<li>controller: don't need to erase node attributes for remote nodes</li>
<li>pacemaker-attrd: Drop "requesting shutdown" code</li>
<li>pacemaker-attrd: Wipe CIB along with memory (gh#ClusterLabs/pacemaker#3991)</li>
<li>libcrmservice: Correctly check the return value of stat.</li>
<li>fencer: Improve validation of pcmk_host_map</li>
<li>fencer: Drop support for escaped characters in pcmk_host_map</li>
<li>fencer: Drop unhelpful message from build_port_aliases()</li>
<li>fencer: Fix ISO 8601 interval parsing in pcmk_delay_base</li>
<li>daemons: When checking for duplicate messages, we might be prepending.</li>
<li>daemons: Don't add repeated I_PE_CALC messages to the fsa queue.</li>
<li>scheduler: promoted state with promoted state with attribute</li>
<li>fencer: Log an error for empty pcmk_delay_base mapping key</li>
<li>fencer: Fix a format string</li>
<li>libcrmservice: List only the requested directory contents</li>
<li>build, libcrmservice: initdir must be a single directory</li>
<li>libcrmservice: Fix memory leaks when listing directory contents</li>
<li>cts: Add cts-lab --nic option used for generated IP address resources (gh#ClusterLabs/pacemaker#3982)</li>
<li>libcrmcommon: Loop on EAGAIN in mainloop_gio_callback.</li>
<li>daemons: Get rid of some logged warnings in execd.</li>
<li>libcrmcommon: Bump feature set to 3.20.5</li>
<li>libcrmcommon: Deprecate stop-removed-resources cluster property</li>
<li>libcrmcommon: Deprecate cancel-removed-actions cluster property</li>
<li>libpe_status: Warn if concurrent-fencing is false</li>
<li>libcrmcommon: Deprecate enable-startup-probes cluster property</li>
<li>libcrmcommon: Rename stop-removed-actions to cancel-removed-actions</li>
<li>libcrmcommon: Deprecate cluster-ipc-limit cluster option</li>
<li>cts-cli: Escape special characters in the path for a pattern (gh#ClusterLabs/pacemaker#3971)</li>
<li>tools: Handle large timeouts correctly in crm_resource --wait</li>
<li>controller: NULL-check lrm_state before dereferencing it</li>
<li>tools: cibsecret should work with CIB_file set.</li>
<li>controller: Avoid "stonith" in log messages</li>
<li>tools: Use "fencing" in stonith_admin/crm_resource</li>
<li>libpe_status: Use "fencing" instead of "STONITH" in some logs</li>
<li>libcrmcommon: New "fencing-reaction" cluster property</li>
<li>libcrmcommon: New "fencing-watchdog-timeout" cluster property</li>
<li>libcrmcommon: New "fencing-timeout" cluster property</li>
<li>libcrmcommon: New "fencing-max-attempts" cluster property</li>
<li>libcrmcommon: New "fencing-action" cluster property</li>
<li>libcrmcommon: New "fencing-enabled" cluster property</li>
<li>libcrmcommon: Update documentation for cluster-ipc-limit.</li>
<li>libcrmcommon: Be more lenient in evicting IPC clients.</li>
<li>tools: Deprecate iso8601 command line tool</li>
<li>libcrmcommon: Show deprecated option aliases in outputs</li>
<li>libcrmcommon: Parse iso8601 strings according to spec.</li>
<li>fencer: Prevent unsigned int overflow in get_action_timeout()</li>
<li>libcrmcommon: Fix integer overflow of alert timeouts</li>
<li>libcrmcommon: Ensure stonith watchdog timeout is in long range</li>
<li>controller, fencer: Ignore negative/unparsable pcmk_monitor_timeout</li>
<li>cts: Drop cts script</li>
<li>tools: Drop crm_report -T/--cts and --cts-log options</li>
<li>schemas: Deprecate "orphaned" attribute</li>
<li>schemas: resource XML element has new "removed" attribute</li>
<li>schemas: Deprecate "orphan" attribute in crm_mon and crm_simulate</li>
<li>schemas: resource_history XML element has new "removed" attribute</li>
<li>libcrmcommon: Fix a segfault in internal_ipc_get_reply. (bsc#1255371, gh#ClusterLabs/pacemaker#3949)</li>
<li>libcrmcommon: New "stop-removed-resources" cluster property</li>
<li>libcrmcommon: New "stop-removed-actions" cluster property</li>
<li>sysconfig: Remove --leak-check=full from default VALGRIND_OPTS.</li>
<li>tools: Hide crm_mon --as-xml option</li>
<li>crm_mon: Deprecate --pid-file/-p option</li>
<li>tools: Fix CIB validation in crm_mon.c</li>
<li>libcib, libcrmcommon: Improve a couple of log messages</li>
<li>libcrmcommon: pcmk__quote_cmdline() returns valid shell string</li>
<li>libcrmcommon: Bump feature set to 3.20.4</li>
<li>schemas: Add a schema for cibadmin</li>
<li>tools: Use formatted output in cibadmin</li>
<li>tools: Formatted output for cibadmin --show-access --query</li>
<li>tools: Formatted output for cibadmin --node-path</li>
<li>tools: Basic cibadmin XML formatted output</li>
<li>tools: Formatted output for cibadmin --empty</li>
<li>tools: Formatted output for cibadmin --md5-sum{,-versioned}</li>
<li>tools: Deprecate cibadmin -e/--node-path option</li>
<li>libcrmcommon: bump feature set to 3.20.3</li>
<li>schemas: Add a schema for cibsecret.</li>
<li>libcrmcommon: Return a value for md5sum of empty input.</li>
<li>tools: Remove the shell version of cibsecret.</li>
<li>tools: Improve some cibadmin error messages</li>
<li>tools: cibadmin renders ACLs only when output is cib element</li>
<li>tools: cibadmin now errors if unable to compute md5 sum</li>
<li>libcib, tools: Resolve cibadmin TODO re: ACL rendering and input</li>
<li>controller: Avoid crash due to GSource double-free</li>
<li>tools: Deprecate cibadmin -N/--node option</li>
<li>tools: Drop "Digest: " from cibadmin --md5-sum stderr</li>
<li>tools: cibadmin ignores --node-path for non-XPath-query command</li>
<li>tools: Change exit codes for failure to create cib_t object</li>
<li>libcib: Fix cib__signon_retry() return code</li>
<li>tools: Deprecate cibadmin --show-access as non-privileged user</li>
<li>tools: Don't require --force for non-privileged cibadmin ACLs</li>
<li>tools: Default cibadmin command is now --query</li>
<li>tools: Deprecate current input source precedence in cibadmin</li>
<li>tools: Drop cibadmin --extended-version/-! option</li>
<li>libcrmcommon: Bump feature set to 3.20.2</li>
<li>schemas: Add a schema for crm_diff</li>
<li>tools: Use formatted output in crm_diff.c</li>
<li>libcrmcommon: Standardize remote environment variable parsing</li>
<li>libcrmcommon: Allow empty string values in pcmk__scan_nvpair()</li>
<li>libcrmcommon: Keep trailing newlines in pcmk__scan_nvpair()</li>
<li>fencer: Fix fence delay range off-by-one</li>
<li>daemons: Return CRM_EX_PROTOCOL when ACKing an unknown request.</li>
<li>daemons: Correct result error string on unknown IPC messages.</li>
<li>daemons: Add a return to do_pe_invoke_callback.</li>
<li>tools: Deprecate crm_diff --stdin</li>
<li>tools: Improve error handling in crm_diff.c</li>
<li>tools: Be stricter about crm_diff --cib/--no-version</li>
<li>libcrmcommon: Don't require version info when applying CIB patches</li>
<li>agents: Error check calling attrd_updater in HealthSMART.</li>
<li>agents: Error check calling attrd_updater in HealthIOWait.</li>
<li>agents: Error out if CPU I/O wait time isn't available.</li>
<li>agents: Error check calling attrd_updater in HealthCPU.</li>
<li>agents: Error out if CPU idleness isn't available.</li>
<li>daemons: Don't log the unresponsive message for a daemon we killed</li>
<li>controller: Avoid blocking wait in controller for CIB re-request</li>
<li>cts: Remove --valgrind-tests</li>
<li>cts: Leave valgrind results around if they're not empty.</li>
<li>NLS: update translations before 3.0.1-rc1</li>
<li>libpacemaker: Prevent CIB growth during crm_simulate --profile</li>
<li>daemons: Fix a toctou bug when fetching additional schemas.</li>
<li>Address coverity issues.</li>
<li>Address certain clang static analysis errors.</li>
<li>libs: Fix cppcheck warnings.</li>
<li>libcrmcommon: bump feature set to 3.20.1</li>
<li>scheduler: Require a cluster option for old remote fencing behavior.</li>
<li>scheduler: Don't always fence online remote nodes.</li>
<li>daemons: Convert schedulerd to support multipart IPC messages.</li>
<li>daemons: Convert attrd to support multipart IPC messages.</li>
<li>daemons: Convert pacemakerd to support multipart IPC messages.</li>
<li>daemons: Convert execd to support multipart IPC messages.</li>
<li>daemons: Convert fenced to support multipart IPC messages.</li>
<li>daemons: Convert controld to support multipart IPC messages.</li>
<li>daemons: Convert based to support multipart IPC messages.</li>
<li>libcrmcommon: Retry on EAGAIN in crm_ipcs_flush_events.</li>
<li>libcrmcommon: All parts of a multipart event should have the same ID</li>
<li>libcrmcommon: Don't immediately overwrite request ID.</li>
<li>libcrmcommon: Check the client buffer in crm_ipc_buffer.</li>
<li>libcrmcommon: Handle sending multi-part IPC server events.</li>
<li>libcrmcommon: crm_ipc_read can receive large IPC messages.</li>
<li>libcrmcommon: Elements should never match if IDs differ</li>
<li>libcrmcommon: Consistently free iov on error.</li>
<li>libcrmcommon: Always free temp node in mark_child_deleted()</li>
<li>libcrmcommon: Fix XML matching when marking changes</li>
<li>fencer: Don't remove device if child is deleted</li>
<li>controller: Populate nodes from peer cache if can't from cluster</li>
<li>libcib: Don't match element based on XPath matching an attribute</li>
<li>tools: Use correct error code for command lookup failure</li>
<li>tools: Dry-run crm_resource --fail if CIB_file is set</li>
<li>libcrmcommon: Sort schema transformations on non-glibc systems</li>
<li>libcrmcommon: Ensure schema transform numbers are in valid range</li>
<li>libcrmcommon: Match literal dots in schema transform filter</li>
<li>spec: Provides user(hacluster) and group(haclient)</li>
<li>libcrmservice: Fix overrides for systemd resources</li>
<li>libcrmservice: Fail systemd rsc start if create override fails</li>
<li>Build: Run cts-cli verbosely.</li>
<li>controller: improve resource action execution logs</li>
<li>controller: improve start-up/exit messages</li>
<li>controller: drop dot file logs</li>
<li>controller: simplify join finalization messages</li>
<li>pacemaker-based: improve a few messages</li>
<li>pacemaker-based: improve exit messages</li>
<li>pacemaker-based: improve messages when reading CIB from disk</li>
<li>libpacemaker: Reset scheduler object in pcmk_simulate()</li>
<li>libpe_status: Make cluster_status() idempotent</li>
<li>tools: Fix overflow in crm_simulate --repeat</li>
<li>libpacemaker: Handle scandir() error in pcmk__profile_dir()</li>
<li>libpacemaker: Fix mem leak in pcmk__profile_dir()</li>
<li>tools: Avoid crash in crm_simulate --profile</li>
<li>Makefile: drop asciidoc references</li>
<li>crm_diff: Replace variable name</li>
<li>Drop deprecated '--sync-call' option from cibadmin</li>
<li>Drop deprecated '-l/--local' option from cibadmin in multiple places</li>
<li>raise minimum GnuTLS dependency to 3.4.6</li>
<li>sysconfig: document when logs may show sensitive info</li>
<li>pacemaker-attrd: reduce log spam at shutdown</li>
<li>executor: avoid misleading log when cancelling a recurring monitor</li>
<li>scheduler: improve restart-needed log</li>
<li>scheduler: don't show node capacity for bundle nodes</li>
<li>scheduler: clarify no-quorum effects</li>
<li>libcrmcommon: improve flag set/clear messages</li>
<li>libcrmcommon: improve message for unsupported XPath match</li>
<li>libstonithd: improve action re-attempt message</li>
<li>libcib: Don't send CRM_OP_REGISTER from cib_remote client</li>
<li>tools: mention potential issues with crm_resource --restart</li>
<li>tools: indicate crm_resource --interval can take units</li>
<li>tools: clarify that crm_mon updates are automatic when interactive</li>
<li>agents: Replace the egrep command with the EGREP definition in ping RA</li>
<li>libcrmcluster: fix format typos</li>
<li>doc: drop Inkscape dependency</li>
<li>tools: validate stonith_admin --timeout value</li>
<li>libpacemaker: set fail-count to INFINITY for fatal failures</li>
<li>libpacemaker: add PCMK__XA_FAILED_START_OFFSET and PCMK__XA_FAILED_STOP_OFFSET</li>
<li>tools: Deprecate cibadmin --sync-call</li>
<li>OCF: controld.in: Remove gfs_controld command as it's already obsoleted</li>
<li>xml: Warn about post-transform behavior changes for ACLs with xpath</li>
<li>sysconfig: Document using certificates for remote nodes.</li>
<li>sysconfig: Explain permissions needed on TLS-related files.</li>
<li>libcrmcluster: restore CPG header size compatibility</li>
<li>libcrmcluster: improve messages in pcmk__cpg_message_data()</li>
<li>liblrmd: Enable TLS support for Pacemaker Remote clients.</li>
<li>daemons: Enable TLS support for Pacemaker Remote nodes.</li>
<li>libcrmcommon: Set *tls = NULL in a few more locations.</li>
<li>libcib: Enable TLS certs for remote CIB operations.</li>
<li>libs: Log if a TLS certificate is close to expiration.</li>
<li>libcrmcommon: If the server supports certs, require them...</li>
<li>daemons: Set up X509 auth in based if enabled.</li>
<li>sysconfig: Add env settings needed for X509 authentication.</li>
<li>libcrmcluster: don't assert for CPG decompression error</li>
<li>libcrmcluster: avoid redundant log for invalid CPG messages</li>
<li>libcrmcluster: initialize from in pcmk__cpg_message_data()</li>
<li>scheduler: avoid memory leak in bundles</li>
<li>xml: Preserve ACL reference behavior for replaced constraints</li>
<li>xml: Ensure ACL permissions are valid after XSL transformations</li>
<li>xml: Warn if schema transformation drops remove-after-stop property</li>
<li>xml: Warn if schema transformation drops moon phase</li>
<li>xml: Info if schema transformation drops empty groups or clones</li>
<li>xml: Warn if schema transformation drops colocation/order lifetimes</li>
<li>xml: Warn if schema transformation drops can_fail or...</li>
<li>xml: Warn if schema transformation drops restart-type meta-attr</li>
<li>xml: Warn if schema transformation drops rkt bundles</li>
<li>xml: Warn if schema transformation drops nagios/upstart resources</li>
<li>log: Allow CIB upgrade messages to start with W, I, D</li>
<li>various: clean up library memory at child exit</li>
<li>pacemaker-remoted: improve exit codes for schema failures</li>
<li>controller: avoid memory leak when updating join phase</li>
<li>scheduler: avoid memory leak when freeing node copies</li>
<li>libcrmcommon: drop unhelpful trace message</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP applications 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-1882</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (ppc64le x86_64)
<ul>
<li>pacemaker-3.0.3+20260728.7052efa194-160000.1.1</li>
<li>pacemaker-libs-3.0.3+20260728.7052efa194-160000.1.1</li>
<li>pacemaker-cli-debuginfo-3.0.3+20260728.7052efa194-160000.1.1</li>
<li>pacemaker-devel-3.0.3+20260728.7052efa194-160000.1.1</li>
<li>pacemaker-debuginfo-3.0.3+20260728.7052efa194-160000.1.1</li>
<li>pacemaker-libs-debuginfo-3.0.3+20260728.7052efa194-160000.1.1</li>
<li>pacemaker-remote-debuginfo-3.0.3+20260728.7052efa194-160000.1.1</li>
<li>pacemaker-debugsource-3.0.3+20260728.7052efa194-160000.1.1</li>
<li>pacemaker-cli-3.0.3+20260728.7052efa194-160000.1.1</li>
<li>pacemaker-remote-3.0.3+20260728.7052efa194-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
<ul>
<li>python3-pacemaker-3.0.3+20260728.7052efa194-160000.1.1</li>
<li>pacemaker-cts-3.0.3+20260728.7052efa194-160000.1.1</li>
<li>pacemaker-schemas-3.0.3+20260728.7052efa194-160000.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-10649.html">https://www.suse.com/security/cve/CVE-2026-10649.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1180966">https://bugzilla.suse.com/show_bug.cgi?id=1180966</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1249217">https://bugzilla.suse.com/show_bug.cgi?id=1249217</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1255371">https://bugzilla.suse.com/show_bug.cgi?id=1255371</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259345">https://bugzilla.suse.com/show_bug.cgi?id=1259345</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265183">https://bugzilla.suse.com/show_bug.cgi?id=1265183</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265201">https://bugzilla.suse.com/show_bug.cgi?id=1265201</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268381">https://bugzilla.suse.com/show_bug.cgi?id=1268381</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1270354">https://bugzilla.suse.com/show_bug.cgi?id=1270354</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271652">https://bugzilla.suse.com/show_bug.cgi?id=1271652</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272452">https://bugzilla.suse.com/show_bug.cgi?id=1272452</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1279543">https://bugzilla.suse.com/show_bug.cgi?id=1279543</a>
</li>
</ul>
</div>