Corosync Security Update: Denial of Service and Information Disclosure Vulnerabilities
Summary
ALSA-2026:13673: Moderate: corosync security update. Affects corosync versions < 3.1.9-2.el9_7.1. Fixed in 3.1.9-2.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Corosync is a cluster engine that provides a reliable messaging layer and a set of APIs for cluster management in AlmaLinux environments. It is essential for ensuring high availability and fault tolerance in clustered applications. However, recent vulnerabilities have been identified that could compromise the integrity and availability of systems using Corosync.
Vulnerability Detail
The vulnerabilities in Corosync stem from improper handling of crafted UDP packets and integer overflow in join message validation. These issues can lead to Denial of Service (DoS) attacks, where the service becomes unavailable to legitimate users, and potential information disclosure, where sensitive data may be exposed to unauthorized entities. Specifically, CVE-2026-35091 allows attackers to exploit crafted packets to disrupt service, while CVE-2026-35092 involves an integer overflow that can also lead to service interruptions.
How To Fix
Minimum fixed version
3.1.9-2.el9_7.1
This is the first release that contains the fix.
sudo dnf update corosyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit access to the Corosync service by configuring firewall rules to restrict incoming UDP traffic to trusted sources only. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The identified vulnerabilities in Corosync pose significant risks to the availability and security of clustered applications in AlmaLinux environments. It is imperative to apply the recommended updates promptly and consider additional security measures to protect against potential exploits.
See every vulnerability recorded for corosync →
FAQ
The main vulnerabilities include Denial of Service and information disclosure due to crafted UDP packets and integer overflow in join message validation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
It is recommended to update your Corosync packages to the patched version 3.1.9-2.el9_7.1 to mitigate the vulnerabilities.
While specific exploits have not been publicly disclosed, the nature of the vulnerabilities suggests that they could be exploited by attackers to disrupt service and potentially access sensitive information.
If immediate updates are not possible, consider implementing firewall rules to restrict access to the Corosync service as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for corosync.
