diff --git a/pacemaker.spec b/pacemaker.spec
index 73187b0..f6902fa 100644
--- a/pacemaker.spec
+++ b/pacemaker.spec
@@ -35,11 +35,11 @@
 ## Upstream pacemaker version, and its package version (specversion
 ## can be incremented to build packages reliably considered "newer"
 ## than previously built packages with the same pcmkversion)
-%global pcmkversion 2.1.10
-%global specversion 3
+%global pcmkversion 2.1.11
+%global specversion 1
 
 ## Upstream commit (full commit ID, abbreviated commit ID, or tag) to build
-%global commit 5693eaeeef06faa1622515963082b5a1731d9fc0
+%global commit df49d4179c8d4f995df9d501e9b3febf7d83fe30
 
 ## Since git v2.11, the extent of abbreviation is autoscaled by default
 ## (used to be constant of 7), so we need to convey it for non-tags, too.
@@ -918,6 +918,10 @@ exit 0
 %license %{nagios_name}-%{nagios_hash}/COPYING
 
 %changelog
+* Mon Jun 29 2026 Chris Lumens <clumens@redhat.com> - 2.1.11-1
+- Fix integer overflows in remote message decompression code (CVE-2026-10649)
+- Resolves: RHEL-181156
+
 * Mon May 11 2026 Chris Lumens <clumens@redhat.com> - 2.1.10-3
 - Don't hang waiting on certain pending monitor actions
 - Resolves: RHEL-153661
diff --git a/sources b/sources
index e122b3a..6a26ee6 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (nagios-agents-metadata-105ab8a7b2c16b9a29cf1c1596b80136eeef332b.tar.gz) = 11ddeb48a4929e7642b6dfa9c7962aa1d7a1af1c569830f55ed6cd6773abac13377317327bc1db8411c8077884f83f81cc54d746c834b63a99fa6dc219b5caad
-SHA512 (pacemaker-5693eaeee.tar.gz) = b737d04d57613dfa0650decb28a6a2e673d4024e87990e4634fa61673652cde0db612709c8ba7b85d338b3d863444075752ed96613a27d2fa67e4b2238baed33
+SHA512 (pacemaker-df49d4179.tar.gz) = a7c051a2175c9e4529086488ecd8c947d416415f98447c5fe6a9761a4a6202760340480e2e4a6ac7858030384185e6c12786bc18fbd7974b12b4d749e39284c9