CVE-2026-35092

CWE-190 — Integer Overflow11 documents9 sources
Severity
7.5HIGH
EPSS
1.0%
top 23.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat Enterprise LinuxRedhat Openshift
Timeline
PublishedApr 1
Latest updateApr 13

Description

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This vulnerability specifically affects Corosync deployments configured to use totemudp/totemudpu mode.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

Also affects: Enterprise Linux 10.0, 7.0, 8.0, 9.0

🔴Vulnerability Details

4
OSV
CVE-2026-35092: (A flaw was found in Corosync↗2026-04-02
▶
GHSA
GHSA-g4g9-h6f9-v5x2: A flaw was found in Corosync↗2026-04-01
▶
OSV
CVE-2026-35092: A flaw was found in Corosync↗2026-04-01
▶
CVEList
Corosync: corosync: denial of service via integer overflow in join message validation↗2026-04-01
▶

📋Vendor Advisories

3
Ubuntu
Corosync vulnerabilities↗2026-04-13
▶
Red Hat
corosync: Corosync: Denial of Service via integer overflow in join message validation↗2026-04-01
▶
Debian
CVE-2026-35092: corosync - A flaw was found in Corosync. An integer overflow vulnerability in Corosync's jo...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-35092 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

2
Bugzilla
CVE-2026-35092 corosync: Corosync: Denial of Service via integer overflow in join message validation [fedora-all]↗2026-04-01
▶
Bugzilla
CVE-2026-35092 corosync: Corosync: Denial of Service via integer overflow in join message validation↗2026-04-01
▶