Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send crafted UDP packet
  2. Exploit
    Trigger integer overflow in join message validation
  3. Execution
    Crash Corosync service
  4. Impact
    Denial of service achieved

Vulnerability Assessment

Weakness
CWE
CWE-190
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Corosync cluster configured with totemudp or totemudpu transport mode enabled. Remote unauthenticated attacker sends crafted UDP packets to Corosync cluster nodes. No victim interaction required. Affects default Corosync installations using UDP-based cluster communication.
Impact

Real-world risk is MODERATE despite CVSS 7.5 High severity. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation with low complexity and no authentication required, enabling trivial remote DoS. However, exploitability is constrained by deployment context: only Corosync instances using totemudp/totemudpu mode are vulnerable, and many modern deployments have migrated to knet transport. Impact is limited to availability (A:H) with no confidentiality or integrity compromise, meaning attackers can only crash the service, not gain code execution or data access. No public exploit identified at time of analysis and no CISA KEV listing, suggesting exploitation is not widespread. EPSS score not provided, but the low barrier to exploitation (network-reachable UDP service, no auth) and potential to disrupt critical HA infrastructure warrant prioritization for environments running vulnerable configurations. SSVC assessment: exploitation status is POC (public technical details available via Red Hat Bugzilla); automatable (simple UDP packet crafting); technical impact is partial (availability only). Organizations using Corosync in production HA clusters should treat as high priority.
Exploit ScenarioDerived

An external attacker scans for Corosync cluster nodes exposed on corporate networks or cloud environments, identifying UDP port 5405 (default totemudp). The attacker crafts UDP packets with manipulated join messages containing integer overflow payloads that bypass sanity checks in the message parser. When Corosync processes the malformed packet, the integer overflow corrupts internal state, causing the daemon to crash with a segmentation fault or assertion failure. This triggers cluster quorum loss, destabilizing high-availability services relying on Corosync for coordination (e.g., Pacemaker-managed applications, shared storage clusters). Repeated exploitation can sustain prolonged service outages. Publicly available exploit code exists via technical disclosures in Red Hat Bugzilla, lowering the skill barrier for exploitation.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 01, 2026

Remote denial of service via integer overflow in Corosync cluster engine affects Red Hat Enterprise Linux 7-10 and OpenShift Container Platform 4. Unauthenticated attackers can send crafted UDP packets to crash Corosync services running in totemudp/totemudpu mode (CVSS 7.5, AV:N/PR:N). EPSS data not provided; no public exploit identified at time of analysis. Impacts high-availability cluster deployments where Corosync provides quorum and messaging services.

RemediationAI

Patch availability per vendor advisory not independently confirmed from available data; consult Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-35092 and track Red Hat Bugzilla entries 2453169 and 2453814 for patch release announcements. As interim mitigation, organizations can switch Corosync transport from totemudp/totemudpu to knet mode if supported by their RHEL version and cluster configuration, which eliminates exposure to this UDP-based vulnerability. Network-level controls such as restricting UDP access to Corosync ports (default 5405) to trusted cluster nodes via firewall rules or VLANs reduce attack surface. Monitor cluster stability and review Corosync logs for unexpected crashes or malformed message warnings. Apply vendor-released patches immediately upon availability to affected RHEL 7, 8, 9, 10, and OpenShift 4 deployments.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Corosync is a cluster communication engine used in high-availability Linux environments to provide group messaging, quorum, and membership services. This vulnerability (CWE-190: Integer Overflow or Wraparound) affects the join message sanity validation logic when Corosync operates in totemudp or totemudpu transport modes-UDP-based communication protocols for cluster membership. An integer overflow in message parsing allows malformed UDP packets to bypass validation checks, triggering memory corruption or logic errors that crash the daemon. Affected products include Red Hat Enterprise Linux (RHEL) 7, 8, 9, and 10, plus Red Hat OpenShift Container Platform 4, all of which bundle Corosync for HA cluster services (per CPE strings cpe:2.3:a:red_hat:red_hat_enterprise_linux_*). The vulnerability requires Corosync to be configured with UDP transports; deployments using other transport modes (e.g., knet) are not affected.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.5 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Apr 01, 2026 - 20:30 nvd
Patch available
CVE Published
Apr 01, 2026 - 13:18 nvd
HIGH 7.5

DescriptionCVE.org

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leading to a denial of service. This vulnerability specifically affects Corosync deployments configured to use totemudp/totemudpu mode.

Executive ViewAI

Why It Matters

CVE-2026-35092 is a remote denial-of-service vulnerability in Corosync cluster engine affecting Red Hat Enterprise Linux 7-10 and OpenShift Container Platform 4, allowing unauthenticated attackers to crash critical cluster coordination services via crafted UDP packets. Organizations running Corosync-dependent high-availability infrastructure risk cluster instability, failover disruptions, and potential service outages without mitigation.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict Corosync UDP port access (5404-5406) via network ACLs and firewall rules to only authorized cluster member IPs; (2) Deploy network segmentation to isolate cluster communication from untrusted networks; (3) Enable enhanced monitoring and alerting on Corosync process crashes and cluster quorum changes; (4) Document and test manual cluster recovery procedures; (5) Consider temporary deployment of redundant cluster nodes to tolerate single service crashes; (6) Monitor vendor advisories for patch release timelines.

Threat Intelligence Overview

EPSS Score
0.1%
Top 82% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

Related Vulnerabilities in Corosync Remote Authentication Bypass

View all 2
CVE-2026-35091 HIGH
8.2

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2026-97229 CRITICAL POC
10.0
CVE-2017-7529 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 16.1 Fixed
SUSE Linux Enterprise Server for SAP applications 16.1 Fixed
openSUSE Leap 15.6 Fixed
SUSE Linux Enterprise High Availability Extension 12 SP5 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-35092 ADVISORY https://ubuntu.com/security/notices/USN-8170-1 ADVISORY https://vuldb.com/vuln/354661 REF https://access.redhat.com/errata/RHSA-2026:13644 REF https://access.redhat.com/errata/RHSA-2026:13657 REF https://access.redhat.com/errata/RHSA-2026:13673 REF https://access.redhat.com/errata/RHSA-2026:14205 REF https://access.redhat.com/errata/RHSA-2026:14210 REF https://access.redhat.com/errata/RHSA-2026:14211 REF https://access.redhat.com/errata/RHSA-2026:14212 REF https://access.redhat.com/errata/RHSA-2026:14213 REF https://access.redhat.com/errata/RHSA-2026:14214 REF https://access.redhat.com/errata/RHSA-2026:14215 REF https://access.redhat.com/errata/RHSA-2026:14216 REF https://access.redhat.com/errata/RHSA-2026:19043 REF https://access.redhat.com/errata/RHSA-2026:19200 REF https://access.redhat.com/errata/RHSA-2026:20916 REF https://access.redhat.com/security/cve/CVE-2026-35092 REF https://bugzilla.redhat.com/show_bug.cgi?id=2453169 REF https://bugzilla.redhat.com/show_bug.cgi?id=2453814

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy