{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35092", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-04-01T11:35:23.146Z", "datePublished": "2026-04-01T13:18:55.551Z", "dateUpdated": "2026-05-13T08:16:23.462Z"}, "containers": {"cna": {"title": "Corosync: corosync: denial of service via integer overflow in join message validation", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This vulnerability specifically affects Corosync deployments configured to use totemudp/totemudpu mode."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "versions": [{"version": "0:3.1.9-2.el10_1.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux:10.1"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "versions": [{"version": "0:3.1.9-1.el10_0.2", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "versions": [{"version": "0:3.1.8-1.el8_10.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/a:redhat:enterprise_linux:8::crb", "cpe:/a:redhat:enterprise_linux:8::highavailability", "cpe:/a:redhat:enterprise_linux:8::resilientstorage"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "versions": [{"version": "0:3.1.0-3.el8_4.2", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_aus:8.4::highavailability", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "versions": [{"version": "0:3.1.0-3.el8_4.2", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_aus:8.4::highavailability", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "versions": [{"version": "0:3.1.5-2.el8_6.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::highavailability", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::highavailability"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "versions": [{"version": "0:3.1.5-2.el8_6.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::highavailability", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::highavailability"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "versions": [{"version": "0:3.1.5-2.el8_6.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::highavailability", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::highavailability"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "versions": [{"version": "0:3.1.7-1.el8_8.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_e4s:8.8::highavailability", "cpe:/a:redhat:rhel_tus:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::highavailability"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "versions": [{"version": "0:3.1.7-1.el8_8.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_e4s:8.8::highavailability", "cpe:/a:redhat:rhel_tus:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::highavailability"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "versions": [{"version": "0:3.1.9-2.el9_7.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/a:redhat:enterprise_linux:9::highavailability", "cpe:/a:redhat:enterprise_linux:9::resilientstorage"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "versions": [{"version": "0:3.1.5-3.el9_0.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_e4s:9.0::appstream", "cpe:/a:redhat:rhel_e4s:9.0::highavailability", "cpe:/a:redhat:rhel_e4s:9.0::resilientstorage"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "versions": [{"version": "0:3.1.7-1.el9_2.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_e4s:9.2::appstream", "cpe:/a:redhat:rhel_e4s:9.2::highavailability", "cpe:/a:redhat:rhel_e4s:9.2::resilientstorage"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "versions": [{"version": "0:3.1.8-1.el9_4.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_eus:9.4::appstream", "cpe:/a:redhat:rhel_eus:9.4::crb", "cpe:/a:redhat:rhel_eus:9.4::highavailability", "cpe:/a:redhat:rhel_eus:9.4::resilientstorage"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "versions": [{"version": "0:3.1.9-2.el9_6.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_eus:9.6::appstream", "cpe:/a:redhat:rhel_eus:9.6::crb", "cpe:/a:redhat:rhel_eus:9.6::highavailability", "cpe:/a:redhat:rhel_eus:9.6::resilientstorage"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:enterprise_linux:7"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhcos", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift:4"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:13644", "name": "RHSA-2026:13644", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:13657", "name": "RHSA-2026:13657", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:13673", "name": "RHSA-2026:13673", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14205", "name": "RHSA-2026:14205", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14210", "name": "RHSA-2026:14210", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14211", "name": "RHSA-2026:14211", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14212", "name": "RHSA-2026:14212", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14213", "name": "RHSA-2026:14213", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14214", "name": "RHSA-2026:14214", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14215", "name": "RHSA-2026:14215", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14216", "name": "RHSA-2026:14216", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-35092", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453169"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453814", "name": "RHBZ#2453814", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-04-01T11:48:22.309Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "description": "Integer Overflow or Wraparound", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound", "workarounds": [{"lang": "en", "value": "Systems using totemudp or totemudpu should migrate to the supported knet transport and enable encryption."}], "timeline": [{"lang": "en", "time": "2026-04-01T11:32:04.388Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-01T11:48:22.309Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Sebasti\u00e1n Alba Vives for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-05-13T08:16:23.462Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T13:29:07.148266Z", "id": "CVE-2026-35092", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:32:35.483Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35092", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T13:29:07.148266Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:30:10.667Z"}}], "cna": {"title": "Corosync: corosync: denial of service via integer overflow in join message validation", "credits": [{"lang": "en", "value": "Red Hat would like to thank Sebasti\u00e1n Alba Vives for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:3.1.9-2.el10_1.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:3.1.9-1.el10_0.2", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/a:redhat:enterprise_linux:8::crb", "cpe:/a:redhat:enterprise_linux:8::highavailability", "cpe:/a:redhat:enterprise_linux:8::resilientstorage"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "0:3.1.8-1.el8_10.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_aus:8.4::highavailability", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "versions": [{"status": "unaffected", "version": "0:3.1.0-3.el8_4.2", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_aus:8.4::highavailability", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "versions": [{"status": "unaffected", "version": "0:3.1.0-3.el8_4.2", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::highavailability", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::highavailability"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "versions": [{"status": "unaffected", "version": "0:3.1.5-2.el8_6.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::highavailability", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::highavailability"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "versions": [{"status": "unaffected", "version": "0:3.1.5-2.el8_6.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::highavailability", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::highavailability"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.1.5-2.el8_6.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_e4s:8.8::highavailability", "cpe:/a:redhat:rhel_tus:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::highavailability"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "versions": [{"status": "unaffected", "version": "0:3.1.7-1.el8_8.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_e4s:8.8::highavailability", "cpe:/a:redhat:rhel_tus:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::highavailability"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.1.7-1.el8_8.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/a:redhat:enterprise_linux:9::highavailability", "cpe:/a:redhat:enterprise_linux:9::resilientstorage"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:3.1.9-2.el9_7.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.0::appstream", "cpe:/a:redhat:rhel_e4s:9.0::highavailability", "cpe:/a:redhat:rhel_e4s:9.0::resilientstorage"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.1.5-3.el9_0.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.2::appstream", "cpe:/a:redhat:rhel_e4s:9.2::highavailability", "cpe:/a:redhat:rhel_e4s:9.2::resilientstorage"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.1.7-1.el9_2.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.4::appstream", "cpe:/a:redhat:rhel_eus:9.4::crb", "cpe:/a:redhat:rhel_eus:9.4::highavailability", "cpe:/a:redhat:rhel_eus:9.4::resilientstorage"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:3.1.8-1.el9_4.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.6::appstream", "cpe:/a:redhat:rhel_eus:9.6::crb", "cpe:/a:redhat:rhel_eus:9.6::highavailability", "cpe:/a:redhat:rhel_eus:9.6::resilientstorage"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:3.1.9-2.el9_6.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "rhcos", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-04-01T11:32:04.388Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-01T11:48:22.309Z", "value": "Made public."}], "datePublic": "2026-04-01T11:48:22.309Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:13644", "name": "RHSA-2026:13644", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:13657", "name": "RHSA-2026:13657", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:13673", "name": "RHSA-2026:13673", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14205", "name": "RHSA-2026:14205", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14210", "name": "RHSA-2026:14210", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14211", "name": "RHSA-2026:14211", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14212", "name": "RHSA-2026:14212", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14213", "name": "RHSA-2026:14213", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14214", "name": "RHSA-2026:14214", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14215", "name": "RHSA-2026:14215", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:14216", "name": "RHSA-2026:14216", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-35092", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453169"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453814", "name": "RHBZ#2453814", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Systems using totemudp or totemudpu should migrate to the supported knet transport and enable encryption."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This vulnerability specifically affects Corosync deployments configured to use totemudp/totemudpu mode."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-05-13T08:16:23.462Z"}, "x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound"}}, "cveMetadata": {"cveId": "CVE-2026-35092", "state": "PUBLISHED", "dateUpdated": "2026-05-13T08:16:23.462Z", "dateReserved": "2026-04-01T11:35:23.146Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-04-01T13:18:55.551Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:corosync:corosync:-:*:*:*:*:*:*:*", "matchCriteriaId": "5008766D-B12C-48F2-A70A-2344860259C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "5F7E2F04-474D-4196-9CE8-242642990A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This vulnerability specifically affects Corosync deployments configured to use totemudp/totemudpu mode."}], "id": "CVE-2026-35092", "lastModified": "2026-05-06T21:16:00.583", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}]}, "published": "2026-04-01T14:16:57.237", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:13644"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:13657"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:13673"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:14205"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:14210"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:14211"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:14212"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:14213"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:14214"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:14215"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:14216"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://access.redhat.com/security/cve/CVE-2026-35092"}, {"source": "secalert@redhat.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453169"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453814"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Sebasti\u00e1n Alba Vives for reporting this issue.", "bugzilla": {"description": "corosync: Corosync: Denial of Service via integer overflow in join message validation", "id": "2453814", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453814"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This vulnerability specifically affects Corosync deployments configured to use totemudp/totemudpu mode."], "mitigation": {"lang": "en:us", "value": "Restrict network access to Corosync cluster communication ports. Configure firewall rules to limit incoming UDP traffic to the Corosync service (default port 5405) to only trusted hosts within the cluster. This will prevent unauthenticated remote attackers from sending crafted packets to exploit the vulnerability. A service restart may be required for firewall changes to take full effect."}, "name": "CVE-2026-35092", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "corosync", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "corosync", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "corosync", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "corosync", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-04-01T11:48:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-35092\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35092\nhttps://bugzilla.redhat.com/show_bug.cgi?id=2453169"], "statement": "Critical. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted UDP packets, leading to a denial of service. This flaw specifically impacts Corosync deployments configured to use totemudp/totemudpu mode.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat Enterprise Linux 10", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "openshift", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Red Hat OpenShift Container Platform 4", "source": "cna", "vendor": "Red Hat"}, "product": "openshift_container_platform", "vendor": "redhat"}], "analysis": {"en": {"generated_at": "2026-04-07T23:07:55.485135+00:00", "value": {"mitigation_remediation": ["Restrict incoming UDP traffic on Corosync\u2019s port\u202f5405 to only trusted hosts within the cluster using firewall rules.", "Restart the Corosync service to ensure firewall changes take effect.", "Monitor system logs for Corosync crash events and verify that the service remains stable.", "Check for vendor releases that fix the underlying integer overflow and apply the patch when available.", "Consider segmenting the network or limiting exposure of the Corosync communication interface if possible."], "summary": {"action": "Apply Workaround", "impact": "Denial of Service via integer overflow in Corosync"}, "threat_synthesis": {"affected_systems": "Red\u202fHat Enterprise\u202fLinux\u202f10, 7, 8, and 9, as well as Red\u202fHat OpenShift Container Platform\u202f4, are affected when Corosync is configured to use the totemudp/totemudpu mode. Specific Corosync or OS version numbers are not enumerated in the advisory.", "description_and_impact": "A flaw in Corosync allows a remote unauthenticated attacker to send crafted UDP packets that trigger an integer overflow during join message sanity validation, causing the Corosync service to crash and resulting in a denial of service. The weakness is an integer overflow (CWE\u2011190) that can be triggered by malformed totemudp/TOTEMUDPU join messages.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a medium to high severity level. The EPSS score is less than 1\u202f%, signifying a low probability that this flaw will be exploited, and it does not appear in the CISA KEV catalog. Attackers can exploit the flaw by sending crafted UDP packets to Corosync\u2019s default port\u202f5405; the malformed join messages trigger an integer overflow during validation, causing the service to crash. This denial of service can be repeated until the service is manually restarted, potentially disrupting cluster operations."}}}}, "created": "2026-04-02T07:49:12.368439+00:00", "updated": "2026-04-08T19:59:49.124074+00:00", "vendors": ["redhat", "redhat$PRODUCT$enterprise_linux", "redhat$PRODUCT$openshift", "redhat$PRODUCT$openshift_container_platform"]}