CVE-2026-35092: Corosync: corosync: denial of service via integer overflow in join message validation
A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This vulnerability specifically affects Corosync deployments configured to use totemudp/totemudpu mode.
Other sources
Integer overflow (wraparound) vulnerability in Corosync’s join message sanity validation in exec/totemsrp.c. The flaw is in checkmembjoinsanity(), where proclistentries and failedlistentries are attacker-controlled 32-bit unsigned values received from the network and are added together before being promoted to sizet. This allows the addition (proclistentries + failedlistentries) to wrap around in 32-bit arithmetic (e.g., 0x80000000 + 0x80000000 = 0), causing requiredlen to be calculated too small and allowing a short packet to pass validation. As a result, Corosync proceeds with processing malformed input that should have been rejected, which can be exploited remotely without authentication in totemudp/totemudpu mode via crafted UDP packets to crash the service, resulting in a denial of service.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35092?
CVE-2026-35092 is classified with a high severity due to its potential to allow denial of service attacks via integer overflow.
How do I fix CVE-2026-35092?
To fix CVE-2026-35092, ensure you update Corosync to the latest version where the vulnerability has been addressed.
Who is affected by CVE-2026-35092?
CVE-2026-35092 affects users of the Corosync software, particularly those utilizing its messaging functionality.
What type of attack does CVE-2026-35092 enable?
CVE-2026-35092 enables remote denial of service attacks through crafted UDP packets.
Is CVE-2026-35092 exploitable without authentication?
Yes, CVE-2026-35092 can be exploited by unauthenticated remote attackers.