CVE-2013-0250: The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize th...

Security readout for executives and security teams

This vulnerability can let a remote attacker crash affected Corosync cluster software with a crafted packet. For businesses, the main risk is disruption to high-availability clusters that rely on Corosync for node messaging. There is no KEV listing or provided evidence of active exploitation. Exposure is most likely where Corosync cluster communication is reachable from untrusted networks or hosts. Internet exposure would be unusual but higher risk. Isolated cluster networks reduce practical exposure, but internal attackers or compromised adjacent systems may still be relevant. Prioritize remediation for production high-availability clusters, especially those supporting critical services. The issue is not known to be actively exploited from the provided evidence, but a remote crash of cluster coordination software can create meaningful operational downtime. Mitigation focus: Identify any deployed Corosync 2.0 versions below the fixed vendor release.; Upgrade to Corosync 2.3 or a vendor-supported patched package.; Confirm whether distributions backported the referenced upstream fix..

Prepared

Jun 14, 2026, 07:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.