Is CVE-2026-35091 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35091 being exploited in the wild.

How severe is CVE-2026-35091?

High severity, with a CVSS score of 8.2, published 1 April 2026.

Which products and versions are affected?

Corosync 3.1.8, 3.1.9; Corosync Cluster Engine 3.1.8, 3.1.9.

Is there a fix for CVE-2026-35091?

A patch was published on 2026-05-05: Red Hat released security updates (RHSA-2026:13644, RHSA-2026:13657) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35091 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-35091?

Check whether you run Corosync or Corosync Cluster Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35091: Corosync Cluster Engine out-of-bounds read in membership commit token check

CVE-2026-35091 · Severity: high · CVSS 8.2 · Published 2026-04-01

A vulnerability has been identified in Corosync, a core component used to manage high-availability clusters in Linux environments. An unauthenticated attacker can send a specially crafted network packet to crash the service or potentially view small amounts of sensitive system memory. This could lead to a total loss of availability for the cluster and its hosted applications, as well as a limited risk of data exposure.

Technologies: Corosync. Vendors: Corosync.

Quick answers

Is CVE-2026-35091 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35091 being exploited in the wild.
How severe is CVE-2026-35091?: High severity, with a CVSS score of 8.2, published 1 April 2026.
Which products and versions are affected?: Corosync 3.1.8, 3.1.9; Corosync Cluster Engine 3.1.8, 3.1.9.
Is there a fix for CVE-2026-35091?: A patch was published on 2026-05-05: Red Hat released security updates (RHSA-2026:13644, RHSA-2026:13657) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35091 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-35091?: Check whether you run Corosync or Corosync Cluster Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A flaw exists in the Corosync membership commit token sanity check due to an incorrect check of a function return value (CWE-253). By sending a specially crafted UDP packet, a remote unauthenticated attacker can trigger an out-of-bounds read. This vulnerability specifically affects Corosync when running in totemudp or totemudpu modes, which are the default configurations. Successful exploitation can result in a denial of service (DoS) by crashing the cluster engine or the disclosure of limited memory contents. Patches have been released by Red Hat for Enterprise Linux versions 8, 9, and 10.

Affected products

Corosync Corosync Cluster Engine 3.1.8, 3.1.9
Red Hat Enterprise Linux 8, 9, 10
Red Hat OpenShift 4.0

Timeline

2026-04-01: disclosed: Initial disclosure date
2026-05-05: patched: Red Hat released security updates (RHSA-2026:13644, RHSA-2026:13657)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.