Corosync Security Update: Denial of Service Vulnerabilities in Corosync Packages
Summary
ALSA-2026:19043: Moderate: corosync security update. Affects corosync versions < 3.1.10-1.el10_2.1. Fixed in 3.1.10-1.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Corosync is a cluster engine that provides a reliable communication layer for cluster management in AlmaLinux. It facilitates high availability and fault tolerance in distributed systems by enabling nodes to communicate efficiently. The corosync packages include essential components such as corosync, corosync-vqsim, corosynclib, and corosynclib-devel, which are crucial for the operation of cluster software. However, recent vulnerabilities have been identified that could compromise the security and stability of systems utilizing these packages.
Vulnerability Detail
The vulnerabilities identified in the corosync packages include a Denial of Service (DoS) and information disclosure via crafted UDP packets (CVE-2026-35091) and a Denial of Service via integer overflow in join message validation (CVE-2026-35092). These vulnerabilities can be exploited by sending specially crafted packets to the corosync service, potentially leading to service interruptions and unauthorized access to sensitive information.
How To Fix
Minimum fixed version
3.1.10-1.el10_2.1
This is the first release that contains the fix.
sudo dnf update corosyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing network-level controls to filter incoming UDP packets to the corosync service, thereby mitigating the risk of exploitation until the packages can be updated.
Conclusion
The identified vulnerabilities in the corosync packages pose significant risks to the stability and security of systems utilizing this cluster engine. It is crucial to update to the latest patched versions to mitigate these risks effectively. Additionally, implementing temporary workarounds can provide further protection until updates are applied.
See every vulnerability recorded for corosync →
FAQ
Exploitation of these vulnerabilities could lead to Denial of Service, causing the corosync service to crash or become unresponsive, and may also result in unauthorized information disclosure.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By simply uploading your manifest file, you can check for vulnerabilities without needing to install any software.
Yes, implementing network-level controls to filter incoming UDP packets can help mitigate the risks associated with these vulnerabilities until you can apply the necessary updates.
All versions of corosync prior to 3.1.10-1.el10_2.1 are affected by these vulnerabilities.
For more details, you can refer to the CVE pages listed in the references section of the security advisory.
Related vulnerabilities
Recent vulnerabilities recorded for corosync.
