Corosync Security Vulnerability: Denial of Service and Information Disclosure
Summary
ALSA-2026:13644: Moderate: corosync security update. Affects corosync versions < 3.1.9-2.el10_1.1. Fixed in 3.1.9-2.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Corosync is a cluster engine that provides a reliable messaging layer and cluster membership services for high-availability applications. It is widely used in AlmaLinux environments to facilitate communication between nodes in a cluster. The recent vulnerabilities identified in Corosync could potentially disrupt cluster operations and expose sensitive information, thereby compromising the integrity of the cluster.
Vulnerability Detail
The vulnerabilities in Corosync stem from improper handling of crafted UDP packets, which can lead to Denial of Service (DoS) attacks and information disclosure. Specifically, CVE-2026-35091 allows attackers to send specially crafted packets that can crash the service, while CVE-2026-35092 involves an integer overflow in join message validation, also leading to service disruption. These vulnerabilities can be exploited remotely, making them particularly dangerous for systems that rely on Corosync for cluster management.
How To Fix
Minimum fixed version
3.1.9-2.el10_1.1
This is the first release that contains the fix.
sudo dnf update corosyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Corosync service by configuring your firewall to block incoming UDP packets on the ports used by Corosync. This will help mitigate the risk of exploitation until the packages can be updated.
Conclusion
The Corosync security vulnerabilities pose significant risks to cluster operations and data integrity. It is crucial to update the affected packages promptly to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring your software remains secure.
See every vulnerability recorded for corosync →
FAQ
The main vulnerabilities are CVE-2026-35091, which allows Denial of Service via crafted UDP packets, and CVE-2026-35092, which involves an integer overflow in join message validation.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor for open-source vulnerabilities.
Exploitation of these vulnerabilities can lead to service disruption, making the cluster unavailable, and may also expose sensitive information to unauthorized users.
Yes, a patch is available in version 3.1.9-2.el10_1.1 and later for the affected Corosync packages.
If you cannot update immediately, consider implementing firewall rules to restrict access to the Corosync service as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for corosync.
