CVE-2026-35092

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This vulnerability specifically affects Corosync deployments configured to use totemudp/totemudpu mode.

This is an Important denial of service vulnerability in Corosync, affecting deployments configured to use totemudp/totemudpu mode. A remote, unauthenticated attacker can send specially crafted UDP packets to trigger an integer overflow, causing the Corosync service to crash.This issue affects Corosync only when using the legacy totemudp or totemudpu transports with unencrypted communication. These are not the default.The default transport is knet, which supports encryption and is the standard configuration in RHEL. The totemudp and totemudpu transports are unsupported in RHEL and require explicit manual configuration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Systems using totemudp or totemudpu should migrate to the supported knet transport and enable encryption.