CVE-2026-16530: Pcp: pcp: remote denial of service and information leakage
A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.
Other sources
Summary: pmLogLoadInDom() contains bounds check that prevents a string index (idx) from exceeding the buffer, but this check is guarded by if (acp != NULL). In the streaming path used by the logger servlet (POST /logger/meta), acp is always NULL (hardcoded at the call site), so the check never executes. An attacker can submit a TYPEINDOM record with an arbitrary idx value causing namelist[i] to point to any heap offset, which is subsequently dereferenced by strlen/strdup in the caller, triggering a crash or enabling heap information leakage. Prerequisites: pmproxy reachable on TCP 44322 (default). A valid archive ID obtained from a prior POST /logger/label (no authentication required for either request).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16530?
The severity of CVE-2026-16530 is classified as medium with a score of 6.5.
What impact does CVE-2026-16530 have on systems?
CVE-2026-16530 can lead to a remote denial of service and information leakage due to the crashing of the pmproxy service.
How do I fix CVE-2026-16530?
To fix CVE-2026-16530, you should apply the latest patches and updates for the Performance Co-Pilot pmproxy service.
Who is affected by CVE-2026-16530?
CVE-2026-16530 affects systems running the Performance Co-Pilot pmproxy service.
What versions of software are vulnerable to CVE-2026-16530?
The specific vulnerable versions of Performance Co-Pilot pmproxy are not listed, so it is important to check for any updates from your vendor.