Critical Buffer Overflow in Corosync Package: CVE-2026-81665
Summary
RLSA-2026:67872: Important: corosync security update. Affects corosync versions < 0:3.1.10-1.el10_2.2. Fixed in 0:3.1.10-1.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Corosync is a robust open-source cluster engine that provides high availability and scalability for distributed applications. It offers a set of APIs for communication between nodes in a cluster, ensuring reliable message delivery and synchronization. However, a recent vulnerability has been identified that could compromise the integrity of the system, specifically a heap-based buffer overflow during fragmented message reassembly.
Vulnerability Detail
The vulnerability, identified as CVE-2026-81665, is a heap-based buffer overflow that occurs in the totempg assembly buffer when handling fragmented messages. This flaw can potentially allow an attacker to execute arbitrary code, leading to unauthorized access or denial of service. The implications of this vulnerability are severe, as it affects the core functionality of the Corosync cluster engine, which is critical for maintaining the stability and security of clustered environments.
How To Fix
Minimum fixed version
0:3.1.10-1.el10_2.2
This is the first release that contains the fix.
sudo dnf update corosyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the exposure of your Corosync service by implementing network-level controls to restrict access to trusted hosts only. This can help mitigate the risk until the package is updated.
Conclusion
The Corosync package has a critical vulnerability (CVE-2026-81665) that poses significant risks to clustered environments. It is crucial to update to the latest version to mitigate these risks. Utilize tools like Vulert to monitor your applications for vulnerabilities effectively.
See every vulnerability recorded for corosync →
FAQ
CVE-2026-81665 is a critical vulnerability in the Corosync package that allows for a heap-based buffer overflow during fragmented message reassembly.
This vulnerability can lead to arbitrary code execution, potentially allowing attackers to gain unauthorized access or disrupt services in a clustered environment.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for CVE-2026-81665 is 7.5, indicating a high severity level.
If immediate updates are not possible, implement network-level restrictions to limit access to the Corosync service and monitor for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for corosync.
