CVE-2026-35091

Corosync: corosync: denial of service and information disclosure via crafted udp packet

State: Published
Severity: 8.2 High
Published: Apr 1, 2026
Updated: Aug 21, 2026
Reserved: Apr 1, 2026

Description

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	redhat

Weaknesses

CWE-253 Incorrect Check of Function Return Value

Affected Products

Product	Versions
Red Hat Enterprise Linux 10Red Hat	0:3.1.9-2.el10_1.1 and laterNot affected
Red Hat Enterprise Linux 10Red Hat	0:3.1.10-1.el10_2.1 and laterNot affected
Red Hat Enterprise Linux 10.0 Extended Update SupportRed Hat	0:3.1.9-1.el10_0.2 and laterNot affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat	0:2.4.5-7.el7_9.3 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	0:3.1.8-1.el8_10.1 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat	0:3.1.0-3.el8_4.2 and laterNot affected
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRed Hat	0:3.1.0-3.el8_4.2 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat	0:3.1.5-2.el8_6.1 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat	0:3.1.5-2.el8_6.1 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat	0:3.1.5-2.el8_6.1 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat	0:3.1.7-1.el8_8.1 and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat	0:3.1.7-1.el8_8.1 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:3.1.9-2.el9_7.1 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:3.1.10-1.el9_8.1 and laterNot affected
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat	0:3.1.5-3.el9_0.1 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat	0:3.1.7-1.el9_2.1 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat	0:3.1.8-1.el9_4.1 and laterNot affected
Red Hat Enterprise Linux 9.6 Extended Update SupportRed Hat	0:3.1.9-2.el9_6.1 and laterNot affected
Red Hat OpenShift Container Platform 4Red Hat

References

RHSA-2026:13644vendor-advisory
RHSA-2026:13657vendor-advisory
RHSA-2026:13673vendor-advisory
RHSA-2026:14205vendor-advisory
RHSA-2026:14210vendor-advisory
RHSA-2026:14211vendor-advisory
RHSA-2026:14212vendor-advisory
RHSA-2026:14213vendor-advisory
RHSA-2026:14214vendor-advisory
RHSA-2026:14215vendor-advisory
RHSA-2026:14216vendor-advisory
RHSA-2026:19043vendor-advisory
RHSA-2026:19200vendor-advisory
RHSA-2026:20916vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-35091vdb-entry
https://bugzilla.redhat.com/show_bug.cgi?id=2453169
RHBZ#2453813issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.