CVE-2026-81666
MediumCVSS 6.5Summary
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check can be bypassed on 32-bit systems due to an integer overflow, allowing a crafted network packet to trigger out-of-bounds memory access and crash the Corosync daemon, resulting in denial of service for the affected cluster node. The overflow does not occur on 64-bit systems.
Risk Assessment
Risk of cluster node crash and service disruption in clustered environments, especially on 32-bit systems.
Recommendation
Apply the vendor patch or update Corosync to a fixed version; consider migrating to 64-bit systems.
Other vulnerabilities in Corosync
See all- CVE-2026-81665High
A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. Lack of runtime bounds check in release builds allows a network-adjacent attacker to cause a heap overflow with controlled data, potentially crashing the Corosync daemon and causing denial of service to the entire cluster.
- CVE-2026-35092High
A flaw was found in Corosync related to an integer overflow in join message sanity validation. This allows a remote, unauthenticated attacker to send crafted UDP packets, potentially causing the service to crash and leading to a denial of service.
- CVE-2026-35091High
A flaw was found in Corosync that allows a remote unauthenticated attacker to exploit a wrong return value vulnerability in the membership commit token sanity check. By sending a specially crafted UDP packet, the attacker can lead to an out-of-bounds read, resulting in a denial of service (DoS) and potentially disclosing limited memory contents.
Original NVD description (English source)
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.