Is CVE-2026-35092 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35092 being exploited in the wild.

How severe is CVE-2026-35092?

High severity, with a CVSS score of 7.5, published 1 April 2026.

Is there a fix for CVE-2026-35092?

A patch was published on 2026-05-05: Red Hat released security updates (RHSA-2026:13644, RHSA-2026:13657) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35092 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-35092?

Check whether you run Corosync at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35092: Corosync integer overflow in join message validation

CVE-2026-35092 · Severity: high · CVSS 7.5 · Published 2026-04-01

A vulnerability has been identified in Corosync, a core component used to manage high-availability clusters in Linux environments. An attacker can send specially crafted network packets to crash the service, causing a denial-of-service condition. This disruption can prevent servers in a cluster from communicating correctly, potentially leading to application downtime or service outages.

Technologies: Corosync. Vendors: Corosync.

Quick answers

Is CVE-2026-35092 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35092 being exploited in the wild.
How severe is CVE-2026-35092?: High severity, with a CVSS score of 7.5, published 1 April 2026.
Which products and versions are affected?: Corosync 3.1.8, 3.1.9.
Is there a fix for CVE-2026-35092?: A patch was published on 2026-05-05: Red Hat released security updates (RHSA-2026:13644, RHSA-2026:13657) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35092 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-35092?: Check whether you run Corosync at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in Corosync's join message sanity validation logic. The flaw is triggered when the service processes crafted User Datagram Protocol (UDP) packets, specifically affecting deployments configured to use totemudp or totemudpu modes. A remote, unauthenticated attacker can exploit this by sending malicious packets to the cluster engine, leading to a service crash (Denial of Service). The vulnerability is rooted in CWE-190 (Integer Overflow or Wraparound). Patches have been released by Red Hat for various Enterprise Linux versions to address this issue.

Affected products

Corosync Corosync 3.1.8, 3.1.9
Red Hat Enterprise Linux 7.0, 8.0, 9.0, 10.0
Red Hat OpenShift 4.0

Timeline

2026-04-01: disclosed: Initial disclosure of CVE-2026-35092
2026-04-01: advisory: NVD publication date
2026-05-05: patched: Red Hat released security updates (RHSA-2026:13644, RHSA-2026:13657)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.