Moderate Vulnerability in Corosync Package: Denial of Service and Information Disclosure Risks
Summary
RLSA-2026:13657: Moderate: corosync security update. Affects corosync versions < 0:3.1.8-1.el8_10.1. Fixed in 0:3.1.8-1.el8_10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Corosync is a robust open-source cluster engine that provides high availability and messaging services for cluster applications. It is widely used in various Linux distributions, including Rocky Linux, to facilitate communication between nodes in a cluster. The package offers essential APIs for developers to build reliable cluster software. However, recent vulnerabilities have been identified that could compromise the integrity and availability of systems utilizing Corosync.
Vulnerability Detail
The vulnerabilities identified in Corosync include CVE-2026-35091 and CVE-2026-35092. The first vulnerability allows for a Denial of Service (DoS) and information disclosure through crafted UDP packets, which could enable an attacker to disrupt service or extract sensitive information. The second vulnerability arises from an integer overflow in the validation of join messages, also leading to potential DoS conditions. Both vulnerabilities pose significant risks to the stability and security of cluster environments.
How To Fix
Minimum fixed version
0:3.1.8-1.el8_10.1
This is the first release that contains the fix.
sudo dnf update corosyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing network-level controls to filter and block malicious UDP packets that could exploit these vulnerabilities. Additionally, monitor the cluster for unusual activity that may indicate an attempted attack.
Conclusion
The identified vulnerabilities in the Corosync package pose significant risks to cluster environments, including potential Denial of Service and information disclosure. It is crucial for users to update to the latest patched version to ensure the security and stability of their systems. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for corosync →
FAQ
The CVSS score for the vulnerabilities is 8.2, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerabilities could lead to Denial of Service attacks and unauthorized information disclosure, affecting the availability and confidentiality of your cluster applications.
Yes, the vulnerabilities are fixed in Corosync version 0:3.1.8-1.el8_10.1 and later.
If an immediate update is not possible, implement network-level filtering and monitor for unusual activity as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for corosync.
