# CVE-2026-35092: Corosync integer overflow in join message validation

Source: https://junglewise.ai/threats/cve-2026-35092-corosync-integer-overflow-in-join-message-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-01. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-35092 · Severity: high · CVSS 7.5 · Published 2026-04-01

A vulnerability has been identified in Corosync, a core component used to manage high-availability clusters in Linux environments. An attacker can send specially crafted network packets to crash the service, causing a denial-of-service condition. This disruption can prevent servers in a cluster from communicating correctly, potentially leading to application downtime or service outages.

Technologies: [Corosync](https://junglewise.ai/threats/technologies/corosync). Vendors: [Corosync](https://junglewise.ai/threats/vendors/corosync).

## Quick answers

**Is CVE-2026-35092 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35092 being exploited in the wild.

**How severe is CVE-2026-35092?** High severity, with a CVSS score of 7.5, published 1 April 2026.

**Which products and versions are affected?** Corosync 3.1.8, 3.1.9.

**Is there a fix for CVE-2026-35092?** A patch was published on 2026-05-05: Red Hat released security updates (RHSA-2026:13644, RHSA-2026:13657) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35092 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-35092?** Check whether you run Corosync at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in Corosync's join message sanity validation logic. The flaw is triggered when the service processes crafted User Datagram Protocol (UDP) packets, specifically affecting deployments configured to use totemudp or totemudpu modes. A remote, unauthenticated attacker can exploit this by sending malicious packets to the cluster engine, leading to a service crash (Denial of Service). The vulnerability is rooted in CWE-190 (Integer Overflow or Wraparound). Patches have been released by Red Hat for various Enterprise Linux versions to address this issue.

## Affected products

- Corosync Corosync 3.1.8, 3.1.9
- Red Hat Enterprise Linux 7.0, 8.0, 9.0, 10.0
- Red Hat OpenShift 4.0

## Timeline

- 2026-04-01: disclosed: Initial disclosure of CVE-2026-35092
- 2026-04-01: advisory: NVD publication date
- 2026-05-05: patched: Red Hat released security updates (RHSA-2026:13644, RHSA-2026:13657)

## References

- [https://access.redhat.com/errata/RHSA-2026:13644](https://access.redhat.com/errata/RHSA-2026:13644)
- [https://access.redhat.com/errata/RHSA-2026:13657](https://access.redhat.com/errata/RHSA-2026:13657)
- [https://access.redhat.com/errata/RHSA-2026:13673](https://access.redhat.com/errata/RHSA-2026:13673)
- [https://access.redhat.com/errata/RHSA-2026:14205](https://access.redhat.com/errata/RHSA-2026:14205)
- [https://access.redhat.com/errata/RHSA-2026:14210](https://access.redhat.com/errata/RHSA-2026:14210)
- [https://access.redhat.com/errata/RHSA-2026:14211](https://access.redhat.com/errata/RHSA-2026:14211)
- [https://access.redhat.com/errata/RHSA-2026:14212](https://access.redhat.com/errata/RHSA-2026:14212)

## Related threats

- [Corosync integer overflow in membership commit token handling](https://junglewise.ai/threats/cve-2026-81666-corosync-integer-overflow-in-membership-commit-token-handling)
- [Corosync heap-based buffer overflow in Totem message reassembly](https://junglewise.ai/threats/cve-2026-81665-corosync-heap-based-buffer-overflow-in-totem-message-reassembly)
- [Corosync Cluster Engine out-of-bounds read in membership commit token check](https://junglewise.ai/threats/cve-2026-35091-corosync-cluster-engine-out-of-bounds-read-in-membership-commit)