Bug 2506033 (CVE-2026-16530)

Summary:	CVE-2026-16530 PCP: PCP: Remote denial of service and information leakage
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	kgaikwad, rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-07-30

Description OSIDB Bzimport 2026-07-22 07:57:33 UTC

Summary: __pmLogLoadInDom() contains bounds check that prevents a string index (idx)
from exceeding the buffer, but this check is guarded by if (acp != NULL). In the streaming
path used by the logger servlet (POST /logger/meta), acp is always NULL (hardcoded at the
call site), so the check never executes. An attacker can submit a TYPE_INDOM record with an
arbitrary idx value causing namelist[i] to point to any heap offset, which is subsequently
dereferenced by strlen/strdup in the caller, triggering a crash or enabling heap information
leakage.
Prerequisites: pmproxy reachable on TCP 44322 (default). A valid archive ID obtained from
a prior POST /logger/label (no authentication required for either request).