Corosync Vulnerability: Denial of Service and Information Disclosure in AlmaLinux Packages
Summary
ALSA-2026:13657: Moderate: corosync security update. Affects corosync versions < 3.1.8-1.el8_10.1. Fixed in 3.1.8-1.el8_10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Corosync is a robust cluster engine that provides high availability and messaging services for distributed applications. It is widely used in AlmaLinux environments to facilitate communication between nodes in a cluster. The corosync packages include essential components such as corosync, corosync-vqsim, corosynclib, corosynclib-devel, and spausedd, which are critical for maintaining cluster integrity and performance. However, recent vulnerabilities have been identified that could compromise the security and stability of systems utilizing these packages.
Vulnerability Detail
The identified vulnerabilities in the corosync packages include a Denial of Service (DoS) and information disclosure via crafted UDP packets (CVE-2026-35091) and an integer overflow in join message validation leading to another Denial of Service (CVE-2026-35092). These vulnerabilities could allow an attacker to disrupt service availability or gain unauthorized access to sensitive information, posing significant risks to system integrity and data security.
How To Fix
Minimum fixed version
3.1.8-1.el8_10.1
This is the first release that contains the fix.
sudo dnf update corosyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the corosync service to trusted networks only, thereby minimizing exposure to potential attacks. Additionally, monitoring network traffic for unusual UDP packets may help in identifying malicious activity.
Conclusion
The vulnerabilities identified in the corosync packages pose significant risks to AlmaLinux systems, including Denial of Service and information disclosure. It is crucial to update to the patched version to safeguard against these threats. Implementing temporary workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for corosync →
FAQ
The vulnerabilities can lead to Denial of Service attacks and information disclosure, potentially disrupting cluster operations and exposing sensitive data.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check for vulnerabilities without requiring signup.
The vulnerabilities are documented under CVE-2026-35091 and CVE-2026-35092.
Implement network restrictions and monitor for unusual activity as a temporary workaround until you can apply the updates.
While the primary risks are service disruption and information disclosure, it is advisable to ensure regular backups to mitigate any potential data loss.
Related vulnerabilities
Recent vulnerabilities recorded for corosync.
