Skip to main content

Red Hat Enterprise Linux 10 CVE-2026-35091

| EUVDEUVD-2026-17879 HIGH
Incorrect Check of Function Return Value (CWE-253)
2026-04-01 redhat
Buffer Overflow Denial Of Service Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Red Hat
8.2
CVSS 3.1 · Vendor: redhat
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send crafted UDP packet
  2. Exploit
    Trigger wrong return value in token sanity check
  3. Execution
    Cause out-of-bounds memory read
  4. Impact
    Achieve denial of service

Vulnerability Assessment

Weakness
CWE
CWE-253
ASVS 5.0
V16 - Security Logging and Error Handling Incorrect check of return value
Exploitation Conditions

Remote unauthenticated attacker can exploit Corosync default installations running in totemudp or totemudpu mode (default configuration). No authentication, user interaction, or special configuration required. Attacker sends crafted UDP packets to the cluster communication port.
Impact

Real-world risk is significant for organizations running Red Hat HA clustering infrastructure. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates maximum exploitability: network-accessible, low attack complexity, and no authentication required-an attacker merely needs network reachability to UDP ports (typically 5404-5406) used by Corosync. The High availability impact rating reflects that successful exploitation crashes cluster nodes, potentially cascading to complete cluster failure if quorum is lost. The Low confidentiality impact from memory disclosure is secondary but could leak sensitive cluster state information. While no EPSS score or KEV listing is provided to confirm active exploitation, the combination of default-enabled vulnerable configuration, unauthenticated network attack vector, and impact on critical infrastructure components creates immediate remediation priority. The simplicity of UDP packet crafting (AC:L) suggests exploit development is feasible, though no public POC is confirmed. Organizations with internet-exposed or insufficiently segmented cluster networks face elevated risk; proper network isolation to trusted cluster subnets significantly reduces attack surface but does not eliminate insider or lateral-movement threats.
Exploit ScenarioDerived

An attacker with network access to Corosync cluster communication ports (typically UDP 5404-5406) crafts a malformed UDP packet containing an invalid membership commit token designed to trigger the flawed return value check. When a Corosync daemon processes this packet, the incorrect validation logic causes an out-of-bounds memory read, immediately crashing the cluster node process. If the attacker can reach multiple cluster members simultaneously, coordinated packet floods could crash enough nodes to break quorum, rendering the entire high-availability cluster inoperable and taking down dependent services like databases, shared storage, or OpenShift control planes. Memory disclosure from the out-of-bounds read could potentially leak cluster authentication tokens or configuration data in the crash dump, enabling follow-on attacks.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 01, 2026

Out-of-bounds read in Corosync allows unauthenticated remote attackers to crash cluster nodes and potentially leak memory via malformed UDP packets. Affects default totemudp/totemudpu configurations across Red Hat Enterprise Linux 7/8/9/10 and OpenShift Container Platform 4. CVSS 8.2 (High) with network attack vector, low complexity, and no authentication required. EPSS and exploitation status data not available; no public exploit identified at time of analysis. Impacts high-availability clustering infrastructure commonly used in enterprise production environments.

RemediationAI

Organizations should immediately apply vendor-released patches through Red Hat's standard update channels using yum or dnf package managers for RHEL systems and standard OpenShift update procedures for container platforms. The primary remediation is upgrading to patched Corosync versions distributed through Red Hat security advisories linked at https://access.redhat.com/security/cve/CVE-2026-35091. Until patching is complete, implement network-level compensating controls by restricting Corosync UDP traffic (ports 5404-5406) exclusively to trusted cluster member IP addresses using firewall rules or network segmentation. Review and harden cluster network isolation to prevent unauthorized access to cluster communication channels. For OpenShift environments, ensure cluster network policies restrict corosync traffic to control plane nodes only. Monitor cluster logs for unexpected node failures or membership changes that could indicate exploitation attempts. Consult Red Hat Bugzilla entries 2453169 and 2453813 for version-specific guidance and subscribe to Red Hat Security Advisories for your deployed product versions.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Corosync is a cluster communication engine implementing the Totem single-ring ordering and membership protocol, widely deployed in Linux high-availability (HA) clustering solutions like Pacemaker. The vulnerability (CWE-253: Incorrect Check of Function Return Value) exists in the membership commit token validation logic when operating in totemudp or totemudpu modes-the default transport mechanisms using UDP for cluster heartbeat and quorum messages. A coding error in return value handling during sanity checks of incoming commit tokens allows processing of maliciously crafted UDP packets that trigger out-of-bounds memory reads. The affected CPE strings indicate exposure across Red Hat Enterprise Linux 7, 8, 9, and 10, plus OpenShift Container Platform 4 environments where Corosync manages container orchestration cluster quorum. This is particularly critical as Corosync typically runs with elevated privileges and binds to network interfaces for inter-node communication.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
SUSE HIGH
Red Hat 8.2 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Apr 01, 2026 - 20:30 nvd
Patch available
CVE Published
Apr 01, 2026 - 13:18 nvd
HIGH 8.2

DescriptionCVE.org

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents. This vulnerability affects Corosync when running in totemudp/totemudpu mode, which is the default configuration.

Executive ViewAI

Why It Matters

CVE-2026-35091 is a high-severity out-of-bounds read vulnerability in Corosync that allows unauthenticated remote attackers to crash cluster nodes and potentially leak sensitive memory via malformed UDP packets. This directly threatens the availability and confidentiality of high-availability infrastructure across Red Hat Enterprise Linux and OpenShift environments, potentially causing unplanned downtime in production clustering deployments.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to Corosync UDP ports (5404-5405) using firewall rules to trusted cluster nodes and administrative networks only; (2) Deploy network intrusion detection to identify malformed UDP packets targeting Corosync; (3) Implement memory isolation and process monitoring to detect anomalous cluster node behavior; (4) Establish rapid cluster failover procedures to minimize impact of node crashes; (5) Monitor Red Hat errata and Corosync upstream repositories for patch release and prepare staged rollout plan.

Threat Intelligence Overview

EPSS Score
0.1%
Top 77% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

Related Vulnerabilities in Corosync Remote Authentication Bypass

View all 2
CVE-2026-35092 HIGH
7.5

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-107935 CRITICAL
9.3 Oct 09

Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls

Same weakness CWE-253 – Incorrect Check of Function Return Value

View all
CVE-2017-7474 CRITICAL
9.8
CVE-2023-4501 CRITICAL
9.8
CVE-2020-6107 MEDIUM POC
5.5
CVE-2023-34449 MEDIUM POC
5.3
CVE-2026-53090 HIGH
7.8
CVE-2026-0648 HIGH
7.8
CVE-2026-46419 HIGH
7.5
CVE-2024-43521 HIGH
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 16.1 Fixed
SUSE Linux Enterprise Server for SAP applications 16.1 Fixed
openSUSE Leap 15.6 Fixed
SUSE Linux Enterprise High Availability Extension 12 SP5 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-35091 ADVISORY https://ubuntu.com/security/notices/USN-8170-1 ADVISORY https://vuldb.com/vuln/354660 REF https://access.redhat.com/errata/RHSA-2026:13644 REF https://access.redhat.com/errata/RHSA-2026:13657 REF https://access.redhat.com/errata/RHSA-2026:13673 REF https://access.redhat.com/errata/RHSA-2026:14205 REF https://access.redhat.com/errata/RHSA-2026:14210 REF https://access.redhat.com/errata/RHSA-2026:14211 REF https://access.redhat.com/errata/RHSA-2026:14212 REF https://access.redhat.com/errata/RHSA-2026:14213 REF https://access.redhat.com/errata/RHSA-2026:14214 REF https://access.redhat.com/errata/RHSA-2026:14215 REF https://access.redhat.com/errata/RHSA-2026:14216 REF https://access.redhat.com/errata/RHSA-2026:19043 REF https://access.redhat.com/errata/RHSA-2026:19200 REF https://access.redhat.com/errata/RHSA-2026:20916 REF https://access.redhat.com/security/cve/CVE-2026-35091 REF https://bugzilla.redhat.com/show_bug.cgi?id=2453169 REF https://bugzilla.redhat.com/show_bug.cgi?id=2453813

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy