Critical Buffer Overflow Vulnerability in Corosync Package
Summary
ALSA-2026:69277: Important: corosync security update. Affects corosync versions < 3.1.8-1.el8_10.2. Fixed in 3.1.8-1.el8_10.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Corosync is a robust open-source cluster engine that provides high availability and scalability for applications. It facilitates communication between nodes in a cluster, ensuring that they can work together seamlessly. The Corosync packages include essential APIs and services that are integral to AlmaLinux cluster software. However, recent security assessments have revealed a significant vulnerability that could compromise the integrity of the cluster.
Vulnerability Detail
The vulnerability identified as CVE-2026-81665 is a heap-based buffer overflow that occurs in the totempg assembly buffer during the reassembly of fragmented messages. This flaw can be exploited by an attacker to execute arbitrary code, potentially leading to unauthorized access or control over the affected systems. The vulnerability arises from improper handling of memory allocation during message processing, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
3.1.8-1.el8_10.2
This is the first release that contains the fix.
sudo dnf update corosyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users may consider disabling the Corosync service until the update can be applied. This can be done by executing
sudo systemctl stop corosync' in the terminal
However, this is not a long-term solution and should only be used until the patch is implemented.
Conclusion
The Corosync package has a critical vulnerability (CVE-2026-81665) that poses significant risks to system integrity and security. Users are strongly encouraged to update their packages to the latest patched version to mitigate these risks. Temporary workarounds are available, but they do not replace the need for a proper update.
See every vulnerability recorded for corosync →
FAQ
CVE-2026-81665 is a critical vulnerability in the Corosync package that allows for a heap-based buffer overflow, potentially leading to arbitrary code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing the manifest file like package-lock.json, you can check if your application is affected by this vulnerability.
Exploitation of this vulnerability could allow attackers to execute arbitrary code, leading to unauthorized access, data breaches, or complete control over the affected systems.
Yes, a patch has been released in version 3.1.8-1.el8_10.2 of the Corosync packages. Users are advised to update to this version or later.
If immediate updating is not possible, consider stopping the Corosync service as a temporary workaround until the patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for corosync.
