CVE-2026-35091
High · 8.2CVSS
8.2
EPSS
1.1%
Published
Apr 1, 2026
CISA due date
—
The record
A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise High Availability Extension 15 SP4 | corosync | 0 | 2.4.6-150300.12.16.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP5 | corosync | 0 | 2.4.6-150300.12.16.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | corosync | 0 | 2.4.6-150300.12.16.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP7 | corosync | 0 | 2.4.6-150300.12.16.1 |
| openSUSE:Leap 15.6 | corosync | 0 | 2.4.6-150300.12.16.1 |
| openSUSE:Leap 16.0 | corosync | 0 | 3.1.9-160000.3.1 |
| openSUSE:Tumbleweed | corosync | 0 | 3.1.10-4.1 |
Related vulnerabilities
- CVE-2026-35092 A flaw was found in Corosync. Also affects corosync
- CVE-2026-15686 Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution… CWE-253
- CVE-2026-59847 A flaw was found in libssh. CWE-253
- CVE-2026-5818 Incorrect check of function return value in Caliptra Core Runtime Firmware… CWE-253
- CVE-2026-46419 Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly… CWE-253
- CVE-2026-43863 mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c. CWE-253
- GHSA-88ch-q68x-36v7 uutils coreutils has an Incorrect Check of Function Return Value CWE-253
- GHSA-vp6q-mv9j-j428 uutils coreutils incorrectly handles exit codes when processing multiple files CWE-253