LiveActive security incident?Get immediate response
CVE Record

CVE-2026-35092: Corosync: corosync: denial of service via integer overflow in join message validation

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This vulnerability specifically affects Corosync deployments configured to use totemudp/totemudpu mode.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2026-35092 can let an unauthenticated remote attacker crash vulnerable Corosync cluster communications by sending crafted UDP traffic. The resulting outage could disrupt high-availability services. Risk is limited to deployments using totemudp or totemudpu transport modes; confidentiality and data integrity impacts are not identified.

Executive priority

Treat this as a high-priority availability issue for critical clusters. Begin immediate exposure discovery, then patch reachable totemudp or totemudpu deployments through normal emergency-change processes. Accelerate action where Corosync supports revenue, safety, or customer-facing services. Systems without the affected transport configuration can be deprioritized after documented validation.

Technical view

An integer overflow in Corosync join-message sanity validation can permit crafted UDP packets to crash the service. The CVSS 3.1 score is 7.5: network-accessible, low complexity, no privileges or user interaction, with high availability impact only. The supplied Red Hat inventory identifies affected RHEL 7, 8, 9, and 10 packages and marks OpenShift Container Platform 4 unaffected.

Likely exposure

Exposure requires Corosync, an affected package or platform version, totemudp or totemudpu mode, and network reachability to its UDP listener. Internet exposure would increase urgency, but internal attackers or compromised hosts may also reach cluster networks. Deployments using other transport modes are not identified as affected by the supplied evidence.

Exploitation context

The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. Exploitation is nevertheless plausible because no authentication, privileges, or user interaction are required. The supported impact is service crash and denial of service, not code execution, disclosure, or data modification.

Researcher notes

CWE-190 explains the validation failure, but the bundle does not provide the overflowing field, precise arithmetic path, fixed-version boundaries, or crash telemetry. Avoid assuming all Corosync deployments are vulnerable. Confirm package status, transport mode, and UDP reachability. Testing should remain isolated and defensive because crafted traffic may interrupt cluster quorum or dependent services.

Mitigation direction

  • Identify affected Corosync installations and confirm whether totemudp or totemudpu mode is enabled.
  • Apply the applicable Red Hat security advisory update after confirming package and lifecycle compatibility.
  • Restrict Corosync UDP traffic to authorized cluster members using network controls.
  • Prioritize externally reachable and business-critical high-availability clusters.
  • Review current vendor guidance if no applicable advisory or supported update is available.

Validation and detection

  • Inventory Corosync package versions across RHEL 7, 8, 9, and 10 systems.
  • Inspect Corosync transport configuration for totemudp or totemudpu usage.
  • Verify UDP listeners are reachable only from authorized cluster nodes.
  • Confirm installed packages supersede versions identified as affected by Red Hat.
  • Monitor Corosync crashes, unexpected restarts, membership failures, and anomalous UDP traffic.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-190: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Container behavior lookup

The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-35092 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
5Timeline events
1ADP providers
18Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6redhat

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-35092Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineredhat

    Reported to Red Hat.

  2. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  3. Source timelineredhat

    Made public.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Red HatRed Hat Enterprise Linux 10corosync, 0:3.1.9-2.el10_1.1affected
Red HatRed Hat Enterprise Linux 10corosync, 0:3.1.10-1.el10_2.1affected
Red HatRed Hat Enterprise Linux 10.0 Extended Update Supportcorosync, 0:3.1.9-1.el10_0.2affected
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Supportcorosync, 0:2.4.5-7.el7_9.3affected
Red HatRed Hat Enterprise Linux 8corosync, 0:3.1.8-1.el8_10.1affected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportcorosync, 0:3.1.0-3.el8_4.2affected
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Oncorosync, 0:3.1.0-3.el8_4.2affected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportcorosync, 0:3.1.5-2.el8_6.1affected
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Servicecorosync, 0:3.1.5-2.el8_6.1affected
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutionscorosync, 0:3.1.5-2.el8_6.1affected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Servicecorosync, 0:3.1.7-1.el8_8.1affected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutionscorosync, 0:3.1.7-1.el8_8.1affected
Red HatRed Hat Enterprise Linux 9corosync, 0:3.1.9-2.el9_7.1affected
Red HatRed Hat Enterprise Linux 9corosync, 0:3.1.10-1.el9_8.1affected
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutionscorosync, 0:3.1.5-3.el9_0.1affected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutionscorosync, 0:3.1.7-1.el9_2.1affected
Red HatRed Hat Enterprise Linux 9.4 Extended Update Supportcorosync, 0:3.1.8-1.el9_4.1affected
Red HatRed Hat Enterprise Linux 9.6 Extended Update Supportcorosync, 0:3.1.9-2.el9_6.1affected
Red HatRed Hat OpenShift Container Platform 4openshift/ose-rhel-coreos-9unaffected
Weakness

CWE details

CWE-190

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-190 · source CWE mapping

Integer Overflow or Wraparound

Integer Overflow or Wraparound represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs