A flaw was found in Corosync.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 1, 2026 · NIST NVD

   Detected

   A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This vulnerability specifically affects Corosync deployments configured to use totemudp/totemudpu mode.

2. Aug 21, 2026 · NIST NVD

   Updated

   A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This vulnerability specifically affects Corosync deployments configured to use totemudp/totemudpu mode.

Affected

• cpe corosync/corosyncversion unspecified
• cpe redhat/enterprise linux10.0
• cpe redhat/enterprise linux7.0
• cpe redhat/enterprise linux8.0
• cpe redhat/enterprise linux9.0
• cpe redhat/openshift4.0

Sources

• CVE.orgVulnerability recordCVE-2026-35092

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-35092

  A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This v

  nvd.nist.gov

References

• Reference · access.redhat.com
• Reference · access.redhat.com
• Reference · access.redhat.com
• Reference · access.redhat.com
• Reference · access.redhat.com
• Reference · access.redhat.com
• Reference · access.redhat.com
• Reference · access.redhat.com