LiveActive security incident?Get immediate response
CVE Record

CVE-2026-35091: Corosync: corosync: denial of service and information disclosure via crafted udp packet

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents

HighCVSS 8.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2026-35091 lets an unauthenticated remote attacker send a crafted UDP packet to vulnerable Corosync deployments, potentially crashing cluster communication services and exposing limited process memory. For organizations relying on Corosync for high availability, successful attacks could disrupt critical clustered workloads without requiring credentials or user interaction.

Executive priority

Treat this as a high-priority resilience issue for production clusters, especially those supporting critical services. Promptly identify affected deployments, reduce untrusted UDP reachability, and follow the relevant Red Hat advisory. The documented impacts are denial of service and limited disclosure, with no integrity impact or evidence of active exploitation.

Technical view

Incorrect return-value handling during Corosync membership commit-token validation can permit an out-of-bounds read. CVSS 3.1 is 8.2: network-accessible, low complexity, no privileges, and no user interaction. Documented impacts are high availability loss and limited confidentiality exposure; no integrity impact is identified.

Likely exposure

Exposure is highest where affected Corosync packages on listed RHEL 7 ELS, 8, 9, or 10 streams accept UDP from untrusted networks. The bundle marks OpenShift Container Platform 4 unaffected. RHEL presence alone is insufficient; confirm Corosync installation, package version, service state, and UDP reachability.

Exploitation context

The bundle reports KEV as false and provides no cited evidence of active exploitation or public weaponization. This does not prove exploitation is absent. Remote, unauthenticated, low-complexity reachability increases feasibility, while practical exposure depends on whether attackers can reach the Corosync UDP service.

Researcher notes

The flaw is categorized as CWE-253 and involves incorrect return-value handling in commit-token validation. The bundle identifies specific Red Hat package builds as affected but provides no fixed-version thresholds, packet-field details, indicators of compromise, or proof of exploitation. Do not interpret the listed affected builds as remediation targets.

Mitigation direction

  • Inventory Corosync deployments across the listed RHEL 7 ELS, 8, 9, and 10 lifecycle streams.
  • Check the applicable Red Hat advisory for corrected packages or mitigations; the bundle does not identify fixed versions.
  • Minimize network reachability to Corosync UDP services while preserving required cluster communications.
  • Prioritize critical clusters and coordinate remediation using established failover and availability safeguards.

Validation and detection

  • Confirm Corosync is installed, running, and matches an affected package build listed by Red Hat.
  • Map each host to its exact RHEL lifecycle stream and applicable Red Hat advisory.
  • Verify segmentation limits Corosync UDP traffic to required cluster communication paths.
  • After remediation, confirm the installed build is vendor-approved and cluster membership remains healthy.
  • Review Corosync logs and restart history for unexplained failures; crashes alone do not establish exploitation.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-253: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
description · low confidence lookup

Container behavior lookup

The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-35091 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.2 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
5Timeline events
1ADP providers
18Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.2CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H3.94.2redhat

Vulnerability scoring details

Base CVSS 3.1 score

8.2High
CVSS 3.1 vector shape for CVE-2026-35091Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineredhat

    Reported to Red Hat.

  2. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  3. Source timelineredhat

    Made public.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Red HatRed Hat Enterprise Linux 10corosync, 0:3.1.9-2.el10_1.1affected
Red HatRed Hat Enterprise Linux 10corosync, 0:3.1.10-1.el10_2.1affected
Red HatRed Hat Enterprise Linux 10.0 Extended Update Supportcorosync, 0:3.1.9-1.el10_0.2affected
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Supportcorosync, 0:2.4.5-7.el7_9.3affected
Red HatRed Hat Enterprise Linux 8corosync, 0:3.1.8-1.el8_10.1affected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportcorosync, 0:3.1.0-3.el8_4.2affected
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Oncorosync, 0:3.1.0-3.el8_4.2affected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportcorosync, 0:3.1.5-2.el8_6.1affected
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Servicecorosync, 0:3.1.5-2.el8_6.1affected
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutionscorosync, 0:3.1.5-2.el8_6.1affected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Servicecorosync, 0:3.1.7-1.el8_8.1affected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutionscorosync, 0:3.1.7-1.el8_8.1affected
Red HatRed Hat Enterprise Linux 9corosync, 0:3.1.9-2.el9_7.1affected
Red HatRed Hat Enterprise Linux 9corosync, 0:3.1.10-1.el9_8.1affected
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutionscorosync, 0:3.1.5-3.el9_0.1affected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutionscorosync, 0:3.1.7-1.el9_2.1affected
Red HatRed Hat Enterprise Linux 9.4 Extended Update Supportcorosync, 0:3.1.8-1.el9_4.1affected
Red HatRed Hat Enterprise Linux 9.6 Extended Update Supportcorosync, 0:3.1.9-2.el9_6.1affected
Red HatRed Hat OpenShift Container Platform 4openshift/ose-rhel-coreos-9unaffected
Weakness

CWE details

CWE-253

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-253 · source CWE mapping

Incorrect Check of Function Return Value

Incorrect Check of Function Return Value represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs