Critical Heap-Based Buffer Overflow in Corosync Packages
Summary
ALSA-2026:67873: Important: corosync security update. Affects corosync versions < 3.1.10-1.el9_8.2. Fixed in 3.1.10-1.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Corosync is a robust cluster engine that provides high availability and messaging services for distributed applications. It is widely used in various cluster software solutions, particularly in environments that require reliable communication between nodes. The Corosync packages include core components such as corosync, corosync-vqsim, corosynclib, and corosynclib-devel, which are essential for the operation of cluster services in AlmaLinux. However, a critical vulnerability has been identified that could potentially compromise the integrity and security of systems utilizing these packages.
Vulnerability Detail
The vulnerability is a heap-based buffer overflow that occurs in the totempg assembly buffer during the reassembly of fragmented messages. This flaw, identified as CVE-2026-81665, can be exploited by an attacker to execute arbitrary code, potentially leading to unauthorized access, data corruption, or service disruption. The issue arises from improper handling of memory allocation and message fragmentation, making it crucial for users of the affected packages to address this vulnerability promptly.
How To Fix
Minimum fixed version
3.1.10-1.el9_8.2
This is the first release that contains the fix.
sudo dnf update corosyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds recommended for this vulnerability. The best course of action is to apply the security update as soon as it is available.
Conclusion
The identified heap-based buffer overflow vulnerability in Corosync packages poses a significant risk to users of AlmaLinux cluster software. It is crucial to update to the patched version 3.1.10-1.el9_8.2 to mitigate potential threats. Regular monitoring and updates are essential to maintain the security and integrity of your systems.
See every vulnerability recorded for corosync →
FAQ
CVE-2026-81665 is the identifier for a heap-based buffer overflow vulnerability found in the Corosync packages, which can lead to arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Failure to address this vulnerability could result in unauthorized access, data corruption, or service disruptions, compromising the security and reliability of your cluster environment.
Yes, if exploited, this vulnerability could lead to data corruption or loss, as attackers may execute arbitrary code that manipulates or deletes data.
It is recommended to regularly check for updates to your packages, ideally on a weekly basis, to ensure that you are protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for corosync.
