CVE-2026-81665
HighCVSS 7.5Summary
A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. Lack of runtime bounds check in release builds allows a network-adjacent attacker to cause a heap overflow with controlled data, potentially crashing the Corosync daemon and causing denial of service to the entire cluster.
Risk Assessment
The attack can cause unavailability of the entire cluster and, under favorable conditions, enable further exploitation.
Recommendation
Apply available Corosync security updates and restrict cluster network access to trusted hosts only.
Other vulnerabilities in Corosync
See all- CVE-2026-81666Medium
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check can be bypassed on 32-bit systems due to an integer overflow, allowing a crafted network packet to trigger out-of-bounds memory access and crash the Corosync daemon, resulting in denial of service for the affected cluster node. The overflow does not occur on 64-bit systems.
- CVE-2026-35092High
A flaw was found in Corosync related to an integer overflow in join message sanity validation. This allows a remote, unauthenticated attacker to send crafted UDP packets, potentially causing the service to crash and leading to a denial of service.
- CVE-2026-35091High
A flaw was found in Corosync that allows a remote unauthenticated attacker to exploit a wrong return value vulnerability in the membership commit token sanity check. By sending a specially crafted UDP packet, the attacker can lead to an out-of-bounds read, resulting in a denial of service (DoS) and potentially disclosing limited memory contents.
Original NVD description (English source)
A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control.