CVE-2026-16530 Pcp: pcp: remote denial of service and information leakage
Remote attackers can crash the PCP pmproxy service and leak memory via a crafted request, affecting Red Hat and Linux distributions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-16530?
CVE-2026-16530 is a medium-severity denial of service vulnerability in Red Hat Enterprise Linux 10, published on 30 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.
Weakness: CWE-125
Which versions are affected by CVE-2026-16530?
How do I fix CVE-2026-16530?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-16530 being exploited?
There is no known exploitation of CVE-2026-16530 in the wild and no public exploit code.
Sources
Also known as AZL-94386, DEBIAN-CVE-2026-16530, GHSA-m276-429x-f63w, UBUNTU-CVE-2026-16530.