Corosync Security Update: Mitigating Denial of Service Vulnerabilities
Summary
ALSA-2026:19200: Moderate: corosync security update. Affects corosync versions < 3.1.10-1.el9_8.1. Fixed in 3.1.10-1.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Corosync is a cluster engine that provides a framework for high availability and clustering in AlmaLinux environments. It offers essential services such as messaging, membership management, and quorum management, making it a critical component for distributed systems. The recent vulnerabilities identified in Corosync could lead to severe disruptions in service and potential information leaks, emphasizing the need for timely updates and security measures.
Vulnerability Detail
The vulnerabilities in Corosync stem from improper handling of crafted UDP packets and integer overflow in join message validation. Specifically, CVE-2026-35091 allows attackers to exploit the system, leading to Denial of Service (DoS) and information disclosure. CVE-2026-35092 further exacerbates this risk by enabling DoS attacks through integer overflow, potentially causing the service to crash or become unresponsive. These vulnerabilities pose significant risks to system integrity and availability, making it imperative for users to address them promptly.
How To Fix
Minimum fixed version
3.1.10-1.el9_8.1
This is the first release that contains the fix.
sudo dnf update corosyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users may consider implementing network-level controls to filter out suspicious UDP packets. However, this is not a substitute for applying the necessary updates and should only be used until the system can be patched.
Conclusion
The identified vulnerabilities in Corosync pose significant risks to system availability and integrity. It is crucial for users to update their packages to the latest patched version to mitigate these risks. Implementing temporary workarounds can provide short-term relief, but a permanent fix through updates is essential for long-term security.
See every vulnerability recorded for corosync →
FAQ
The vulnerabilities include a Denial of Service and information disclosure via crafted UDP packets (CVE-2026-35091) and a Denial of Service via integer overflow in join message validation (CVE-2026-35092).
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By utilizing the manifest file like package-lock.json, Vulert can help identify if your application is affected by these vulnerabilities.
Yes, a patch is available. Users should update to version 3.1.10-1.el9_8.1 to mitigate the vulnerabilities.
If immediate updates are not possible, consider implementing network-level controls to filter out suspicious packets as a temporary workaround.
For detailed information, refer to the CVE pages associated with CVE-2026-35091 and CVE-2026-35092, which provide insights into the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for corosync.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.