CVE-2026-35092

HIGH

corosync security update

Details

CVSS v3: 7.5
NVD published: 2026-04-01 14:16:57
EPSS: 0.2% probability · 44.4th percentile — 2026-05-05
Affected versions: cpe:2.3:a:corosync:corosync:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift:4.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
Summary: A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This vulnerability specifically affects Corosync deployments configured to use totemudp/totemudpu mode.
Remediation: Not available in our cache.
Exploit info: https://bugzilla.redhat.com/show_bug.cgi?id=2453169

TopVuln sends digest emails with high-risk CVE picks across multiple authoritative sources—curated with EPSS and AI. Choose daily per-stream emails and optional weekly or monthly roundups.

Subscribe — free email digest or paid plan

Information is aggregated from multiple authoritative sources for convenience; verify with NVD and vendors before operational decisions.