CVE-2026-35092 Corosync: corosync: denial of service via integer overflow in join message validation
Remote unauthenticated attackers can crash Corosync services via crafted UDP packets in specific UDP transport modes, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35092?
CVE-2026-35092 is a high-severity vulnerability in Redhat Enterprise Linux, published on 1 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This vulnerability specifically affects Corosync deployments configured to use totemudp/totemudpu mode.
Weakness: CWE-190
Which versions are affected by CVE-2026-35092?
It affects 3 products.
Products include Corosync Corosync, Redhat Enterprise Linux, Redhat Openshift.
How do I fix CVE-2026-35092?
Apply the vendor's patch.
Is CVE-2026-35092 being exploited?
There is no known exploitation of CVE-2026-35092 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
Sources
Also known as AZL-81984, DEBIAN-CVE-2026-35092, GHSA-g4g9-h6f9-v5x2, UBUNTU-CVE-2026-35092.