{"id":"CVE-2026-35091","state":"PUBLISHED","title":"Corosync: corosync: denial of service and information disclosure via crafted udp packet","description":"A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents","publishedAt":"2026-04-01T13:18:53.738Z","updatedAt":"2026-08-21T12:15:34.109Z","severity":{"score":8.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support","Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service","Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service","Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support","Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support","Red Hat Red Hat OpenShift Container Platform 4"],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.9-2.el10_1.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.1"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.10-1.el10_2.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.9-1.el10_0.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:2.4.5-7.el7_9.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::server"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.8-1.el8_10.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/a:redhat:enterprise_linux:8::highavailability","cpe:/a:redhat:enterprise_linux:8::resilientstorage"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.0-3.el8_4.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_aus:8.4::highavailability","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.0-3.el8_4.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_aus:8.4::highavailability","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.5-2.el8_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::highavailability","cpe:/a:redhat:rhel_tus:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::highavailability"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Telecommunications Update Service","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.5-2.el8_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::highavailability","cpe:/a:redhat:rhel_tus:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::highavailability"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.5-2.el8_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::highavailability","cpe:/a:redhat:rhel_tus:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::highavailability"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.7-1.el8_8.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_e4s:8.8::highavailability","cpe:/a:redhat:rhel_tus:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::highavailability"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.7-1.el8_8.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_e4s:8.8::highavailability","cpe:/a:redhat:rhel_tus:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::highavailability"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.9-2.el9_7.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/a:redhat:enterprise_linux:9::highavailability","cpe:/a:redhat:enterprise_linux:9::resilientstorage"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.10-1.el9_8.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/a:redhat:enterprise_linux:9::highavailability","cpe:/a:redhat:enterprise_linux:9::resilientstorage"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.5-3.el9_0.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0::appstream","cpe:/a:redhat:rhel_e4s:9.0::highavailability","cpe:/a:redhat:rhel_e4s:9.0::resilientstorage"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.7-1.el9_2.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::appstream","cpe:/a:redhat:rhel_e4s:9.2::highavailability","cpe:/a:redhat:rhel_e4s:9.2::resilientstorage"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.8-1.el9_4.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4::appstream","cpe:/a:redhat:rhel_eus:9.4::crb","cpe:/a:redhat:rhel_eus:9.4::highavailability","cpe:/a:redhat:rhel_eus:9.4::resilientstorage"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.9-2.el9_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream","cpe:/a:redhat:rhel_eus:9.6::crb","cpe:/a:redhat:rhel_eus:9.6::highavailability","cpe:/a:redhat:rhel_eus:9.6::resilientstorage"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]}],"references":["https://access.redhat.com/errata/RHSA-2026:13644","https://access.redhat.com/errata/RHSA-2026:13657","https://access.redhat.com/errata/RHSA-2026:13673","https://access.redhat.com/errata/RHSA-2026:14205","https://access.redhat.com/errata/RHSA-2026:14210","https://access.redhat.com/errata/RHSA-2026:14211","https://access.redhat.com/errata/RHSA-2026:14212","https://access.redhat.com/errata/RHSA-2026:14213","https://access.redhat.com/errata/RHSA-2026:14214","https://access.redhat.com/errata/RHSA-2026:14215","https://access.redhat.com/errata/RHSA-2026:14216","https://access.redhat.com/errata/RHSA-2026:19043","https://access.redhat.com/errata/RHSA-2026:19200","https://access.redhat.com/errata/RHSA-2026:20916","https://access.redhat.com/security/cve/CVE-2026-35091","https://bugzilla.redhat.com/show_bug.cgi?id=2453169","https://bugzilla.redhat.com/show_bug.cgi?id=2453813"],"weaknesses":["CWE-253"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/35xxx/CVE-2026-35091.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-35091","state":"PUBLISHED","datePublished":"2026-04-01T13:18:53.738Z","dateUpdated":"2026-08-21T12:15:34.109Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-04-01T11:35:23.145Z"},"containers":{"cna":{"title":"Corosync: corosync: denial of service and information disclosure via crafted udp packet","descriptions":[{"lang":"en","value":"A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents"}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.9-2.el10_1.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.1"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.10-1.el10_2.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.9-1.el10_0.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:2.4.5-7.el7_9.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::server"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.8-1.el8_10.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/a:redhat:enterprise_linux:8::highavailability","cpe:/a:redhat:enterprise_linux:8::resilientstorage"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.0-3.el8_4.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_aus:8.4::highavailability","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.0-3.el8_4.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_aus:8.4::highavailability","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.5-2.el8_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::highavailability","cpe:/a:redhat:rhel_tus:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::highavailability"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Telecommunications Update Service","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.5-2.el8_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::highavailability","cpe:/a:redhat:rhel_tus:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::highavailability"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.5-2.el8_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::highavailability","cpe:/a:redhat:rhel_tus:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::highavailability"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.7-1.el8_8.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_e4s:8.8::highavailability","cpe:/a:redhat:rhel_tus:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::highavailability"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.7-1.el8_8.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_e4s:8.8::highavailability","cpe:/a:redhat:rhel_tus:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::highavailability"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.9-2.el9_7.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/a:redhat:enterprise_linux:9::highavailability","cpe:/a:redhat:enterprise_linux:9::resilientstorage"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.10-1.el9_8.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/a:redhat:enterprise_linux:9::highavailability","cpe:/a:redhat:enterprise_linux:9::resilientstorage"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.5-3.el9_0.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0::appstream","cpe:/a:redhat:rhel_e4s:9.0::highavailability","cpe:/a:redhat:rhel_e4s:9.0::resilientstorage"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.7-1.el9_2.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::appstream","cpe:/a:redhat:rhel_e4s:9.2::highavailability","cpe:/a:redhat:rhel_e4s:9.2::resilientstorage"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.8-1.el9_4.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4::appstream","cpe:/a:redhat:rhel_eus:9.4::crb","cpe:/a:redhat:rhel_eus:9.4::highavailability","cpe:/a:redhat:rhel_eus:9.4::resilientstorage"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"corosync","defaultStatus":"affected","versions":[{"version":"0:3.1.9-2.el9_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream","cpe:/a:redhat:rhel_eus:9.6::crb","cpe:/a:redhat:rhel_eus:9.6::highavailability","cpe:/a:redhat:rhel_eus:9.6::resilientstorage"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:13644","name":"RHSA-2026:13644","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13657","name":"RHSA-2026:13657","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13673","name":"RHSA-2026:13673","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14205","name":"RHSA-2026:14205","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14210","name":"RHSA-2026:14210","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14211","name":"RHSA-2026:14211","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14212","name":"RHSA-2026:14212","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14213","name":"RHSA-2026:14213","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14214","name":"RHSA-2026:14214","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14215","name":"RHSA-2026:14215","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14216","name":"RHSA-2026:14216","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19043","name":"RHSA-2026:19043","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19200","name":"RHSA-2026:19200","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20916","name":"RHSA-2026:20916","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-35091","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453169"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453813","name":"RHBZ#2453813","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-253","description":"Incorrect Check of Function Return Value","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-08-21T12:15:34.109Z"},"datePublic":"2026-04-01T11:48:13.254Z","x_redhatCweChain":"CWE-253: Incorrect Check of Function Return Value","workarounds":[{"lang":"en","value":"Systems using totemudp or totemudpu should migrate to the supported knet transport and enable encryption.\n\nDisabling the Corosync service is a valid workaround if clustering is not required, but for active clusters, enabling encryption via knet is the preferred and recommended approach."}],"timeline":[{"lang":"en","time":"2026-04-01T11:31:01.742Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-01T11:48:13.254Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Sebastián Alba Vives for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-01T20:28:59.762709Z","id":"CVE-2026-35091","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-01T20:29:55.615Z"}}]}}}