CVE-2026-35091: Corosync: corosync: denial of service and information disclosure via crafted udp packet
A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents
Other sources
Wrong return value vulnerability in the Corosync membership commit token sanity check in exec/totemsrp.c. The flaw occurs in checkmembcommittokensanity() where truncated messages (msglen < sizeof(struct membcommittoken)) incorrectly return 0 (success) instead of -1 (failure). As a result, messagehandlermembcommittoken() continues processing attacker-controlled, undersized input, performs an allocation based on the short length, and then accesses struct membcommittoken fields beyond the allocated region, triggering an out-of-bounds read (ASAN-confirmed). This can be exploited remotely without authentication in totemudp/totemudpu mode by sending a single crafted UDP packet to the Corosync port (default 5405), causing a denial of service and potentially leaking limited memory contents.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35091?
CVE-2026-35091 has been classified as a moderate severity vulnerability.
How do I fix CVE-2026-35091?
To mitigate CVE-2026-35091, update Corosync to the latest version that addresses this vulnerability.
What type of attack is associated with CVE-2026-35091?
CVE-2026-35091 can lead to denial of service and information disclosure through crafted UDP packets.
Who can exploit CVE-2026-35091?
CVE-2026-35091 can be exploited by a remote unauthenticated attacker.
What component of Corosync is affected by CVE-2026-35091?
CVE-2026-35091 affects the membership commit token sanity check within the Corosync component.