---
id: CVE-2026-16530
title: 'Pcp: pcp: remote denial of service and information leakage'
summary: >-
  A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote
  attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by
  sending a specially crafted request. This bypasses a critical bounds check,
  which c…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-125
vendor: Red Hat
product: pcp
affected:
  - pcp (all versions)
  - pcp
  - pcp
  - pcp (all versions)
  - pcp (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-30T13:37:26.587647Z'
published: '2026-07-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:23:59.346Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-16530'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-16530'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2506033'
    label: RHBZ#2506033
tags:
  - cve.org
epss: 0.00485
epssPercentile: 0.41928
ingestedAt: '2026-11-05T22:38:31.534Z'
---

## Overview

A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

## Affected

- `pcp (all versions)`
- `pcp`
- `pcp`
- `pcp (all versions)`
- `pcp (all versions)`
- `openshift/ose-rhel-coreos-9 (all versions)`
- `openshift/ose-rhel-coreos-9 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this issue, restrict network access to the `pmproxy` service on TCP port 44322 using firewall rules. Alternatively, if the `pmproxy` service is not required, it can be disabled to prevent exploitation.

Example to disable `pmproxy`:
`sudo systemctl stop pmproxy`
`sudo systemctl disable pmproxy`

Note that disabling `pmproxy` may impact functionality that relies on it. A service reload or restart may be required for changes to take effect.