CVE-2026-35092
High · 7.5CVSS
7.5
EPSS
1.3%
Published
Apr 1, 2026
CISA due date
—
The record
A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This vulnerability specifically affects Corosync deployments configured to use totemudp/totemudpu mode.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise High Availability Extension 15 SP4 | corosync | 0 | 2.4.6-150300.12.16.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP5 | corosync | 0 | 2.4.6-150300.12.16.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | corosync | 0 | 2.4.6-150300.12.16.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP7 | corosync | 0 | 2.4.6-150300.12.16.1 |
| openSUSE:Leap 15.6 | corosync | 0 | 2.4.6-150300.12.16.1 |
| openSUSE:Leap 16.0 | corosync | 0 | 3.1.9-160000.3.1 |
Related vulnerabilities
- CVE-2026-35091 A flaw was found in Corosync. Also affects corosync
- CVE-2026-110264 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before… CWE-190
- CVE-2026-53615 util-linux is a random collection of Linux utilities. CWE-190
- CVE-2026-106574 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-190
- CVE-2026-106571 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-190
- CVE-2026-75820 GNU Aspell contains an integer truncation vulnerability in the WritableDict::add()… CWE-190
- CVE-2026-102621 A vulnerability was identified in Freedesktop Poppler up to 26.08.0. CWE-190
- CVE-2026-102620 A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. CWE-190