CVE-2026-35092
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A flaw was found in Corosync related to an integer overflow in join message sanity validation. This allows a remote, unauthenticated attacker to send crafted UDP packets, potentially causing the service to crash and leading to a denial of service.
Risk Assessment
This vulnerability poses a denial of service risk for Corosync deployments configured to use totemudp/totemudpu mode, which can affect system availability.
Recommendation
It is recommended to update Corosync to the latest version to mitigate this vulnerability and to monitor network traffic for potential attacks.
Other vulnerabilities in Corosync
See all- CVE-2026-81666Medium
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check can be bypassed on 32-bit systems due to an integer overflow, allowing a crafted network packet to trigger out-of-bounds memory access and crash the Corosync daemon, resulting in denial of service for the affected cluster node. The overflow does not occur on 64-bit systems.
- CVE-2026-81665High
A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. Lack of runtime bounds check in release builds allows a network-adjacent attacker to cause a heap overflow with controlled data, potentially crashing the Corosync daemon and causing denial of service to the entire cluster.
- CVE-2026-35091High
A flaw was found in Corosync that allows a remote unauthenticated attacker to exploit a wrong return value vulnerability in the membership commit token sanity check. By sending a specially crafted UDP packet, the attacker can lead to an out-of-bounds read, resulting in a denial of service (DoS) and potentially disclosing limited memory contents.
Original NVD description (English source)
A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This vulnerability specifically affects Corosync deployments configured to use totemudp/totemudpu mode.