CVE-2026-35091
HighCVSS 8.2Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
A flaw was found in Corosync that allows a remote unauthenticated attacker to exploit a wrong return value vulnerability in the membership commit token sanity check. By sending a specially crafted UDP packet, the attacker can lead to an out-of-bounds read, resulting in a denial of service (DoS) and potentially disclosing limited memory contents.
Risk Assessment
The organization may be exposed to DoS attacks that can disrupt service availability. Additionally, there is a risk of disclosing sensitive data from memory.
Recommendation
It is recommended to update Corosync to the latest version to mitigate this vulnerability. Monitoring UDP traffic for suspicious packets is also advised.
Other vulnerabilities in Corosync
See all- CVE-2026-81666Medium
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check can be bypassed on 32-bit systems due to an integer overflow, allowing a crafted network packet to trigger out-of-bounds memory access and crash the Corosync daemon, resulting in denial of service for the affected cluster node. The overflow does not occur on 64-bit systems.
- CVE-2026-81665High
A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. Lack of runtime bounds check in release builds allows a network-adjacent attacker to cause a heap overflow with controlled data, potentially crashing the Corosync daemon and causing denial of service to the entire cluster.
- CVE-2026-35092High
A flaw was found in Corosync related to an integer overflow in join message sanity validation. This allows a remote, unauthenticated attacker to send crafted UDP packets, potentially causing the service to crash and leading to a denial of service.
Original NVD description (English source)
A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents