Critical Buffer Overflow Vulnerability in Corosync Packages
Summary
ALSA-2026:67872: Important: corosync security update. Affects corosync versions < 3.1.10-1.el10_2.2. Fixed in 3.1.10-1.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Corosync is a cluster engine that provides high availability and scalability for distributed applications. It offers a set of APIs for communication between nodes in a cluster, ensuring that they can work together seamlessly. The Corosync packages are essential for AlmaLinux cluster software, enabling reliable messaging and coordination among cluster members. However, a recently discovered vulnerability poses a significant risk to the integrity and security of these systems.
Vulnerability Detail
The vulnerability identified as CVE-2026-81665 is a heap-based buffer overflow that occurs in the totempg assembly buffer during the reassembly of fragmented messages. This flaw can be exploited by an attacker to execute arbitrary code, potentially leading to unauthorized access, data corruption, or service disruption. The issue arises from improper handling of memory allocation, which allows for excessive data to be written to a buffer, exceeding its allocated size.
How To Fix
Minimum fixed version
3.1.10-1.el10_2.2
This is the first release that contains the fix.
sudo dnf update corosyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their Corosync services by implementing network firewalls to restrict access to trusted IP addresses only. This can help mitigate the risk of exploitation until the packages are updated.
Conclusion
The critical buffer overflow vulnerability in Corosync packages poses a serious risk to systems utilizing AlmaLinux cluster software. It is essential for users to update their packages to the latest patched versions to mitigate potential exploitation. Implementing temporary workarounds can provide additional protection until updates are applied.
See every vulnerability recorded for corosync →
FAQ
The vulnerability is a heap-based buffer overflow that can be exploited to execute arbitrary code.
The affected packages include corosync, corosync-vqsim, corosynclib, and corosynclib-devel.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing network firewalls to limit access to the Corosync services as a temporary workaround.
For more details, refer to the CVE page for CVE-2026-81665, which provides in-depth information about the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for corosync.
