Critical Buffer Overflow Vulnerability in Corosync Package
Summary
RLSA-2026:69277: Important: corosync security update. Affects corosync versions < 0:3.1.8-1.el8_10.2. Fixed in 0:3.1.8-1.el8_10.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Corosync is a robust cluster engine that provides high availability and scalability for Rocky Linux cluster software. It facilitates communication between cluster nodes and ensures data consistency across distributed systems. However, a recent security vulnerability has been identified that could compromise the integrity of the system, making it crucial for users to address this issue promptly.
Vulnerability Detail
The vulnerability, identified as CVE-2026-81665, is a heap-based buffer overflow that occurs in the totempg assembly buffer during the reassembly of fragmented messages. This flaw can lead to potential exploitation, allowing attackers to execute arbitrary code, disrupt service, or gain unauthorized access to sensitive data. The severity of this vulnerability is underscored by its CVSS score of 7.5, indicating a high risk to affected systems.
How To Fix
Minimum fixed version
0:3.1.8-1.el8_10.2
This is the first release that contains the fix.
sudo dnf update corosyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of the Corosync service by implementing network-level restrictions to prevent unauthorized access. However, this is not a substitute for applying the security update.
Conclusion
The identified vulnerability in the Corosync package poses a significant risk to systems running Rocky Linux. Users are urged to update to the latest patched version to safeguard their systems against potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring of open-source vulnerabilities.
See every vulnerability recorded for corosync →
FAQ
CVE-2026-81665 is a security vulnerability in the Corosync package that allows for a heap-based buffer overflow during fragmented message reassembly.
Exploitation of this vulnerability could lead to arbitrary code execution, service disruption, or unauthorized access to sensitive information.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
It is highly recommended to update the Corosync package to version 0:3.1.8-1.el8_10.2 to mitigate the risk associated with this vulnerability.
While a temporary workaround involves restricting network access to the Corosync service, the best solution is to apply the security update.
Related vulnerabilities
Recent vulnerabilities recorded for corosync.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
