PSA-2026-00083: Proxmox Virtual Environment: Various hardening and robustness improvements for pmxcfs
This Proxmox advisory covers a security issue in Proxmox Virtual Environment.
Key facts
- Fixed in
- pve-cluster 9.1.7
- Advisory id
- PSA-2026-00083
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Several issues which could potentially be triggered by unprivileged users were fixed in pmxcfs: On clusters with a high amount of virtual guests, certain IPCC requests to the running pmxcfs instance could cause a crash/denial of service. A misbehaving IPCC client could cause a crash/denial of service by not reading IPCC responses.
An empty sparse file that is stored on pmxcfs could cause a crash/denial of service when being read. pmxcfs was vulnerable to path confusions with paths containing repeated / characters, which could cause a crash/denial of service or allow reading of root-only files by users in the www-data group.
Requests were parsed from memory still owned by the IPCC client, which allowed users in the www-data group to crash pmxcfs by modifying the contents of an in-flight request. Length fields were not read and checked in all cases before processing the corresponding value fields.
API token values were not compared in constant time, potentially allowing timing attacks. Some checks and error handling paths when parsing or handling malformed messages were incomplete and have been improved.
One overflow issue was found and privately reported by Geoffrey McClinsey. One invalid length check was reported in.
The rest of the issues were found and fixed internally. Packages: pve-cluster.
Affected product named by the advisory: Proxmox Virtual Environment.
Text from the source record.
Fix and mitigation
Upgrade to a fixed release named by Proxmox:
- pve-cluster 9.1.7
Vendor guidance
- Update to the fixed package versions: pve-cluster >= 9.1.7.
End-of-life dates for Proxmox VE
More Proxmox advisories
PSA-2026-00095Nov 10, 2026Proxmox Virtual Environment: Broken privilege checks when modifying container NICsPSA-2026-00094Nov 10, 2026Proxmox Virtual Environment: OCI extraction path escapePSA-2026-00093Nov 10, 2026Proxmox Virtual Environment: FRR config injection issuesPSA-2026-00092Nov 10, 2026Proxmox Virtual Environment: Missing and incomplete ACL checks in the SDN APIPSA-2026-00089Nov 10, 2026Proxmox: Several issues in libpve-http-server-perlPSA-2026-00088Nov 10, 2026Proxmox Virtual Environment: Shell command injection via volume name
Get an email when Proxmox Virtual Environment (VE) publishes the next one.
See Proxmox Virtual Environment (VE)'s last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Proxmox Proxmox Virtual Environment from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
