# CVE-2026-35091: corosync: A flaw was found in Corosync

CVE-2026-35091 is fixed in 17 products on 1 platform, first by RHSA-2026:14205, released April 1, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-35091
- Priority: High
- CVSS: 8.2 (high)
- EPSS: 0.0088
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 1, 2026

## Description

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | corosync Debian 12.15 (bookworm) | 3.1.7-1+deb12u2 | [DEBIAN-CVE-2026-35091](https://patchblox.com/security/data/fix/linux/debian-cve-2026-35091.md) | Apr 1, 2026 |
| Linux | corosync Debian 13.5 (trixie) | 3.1.9-2+deb13u1 | [DEBIAN-CVE-2026-35091](https://patchblox.com/security/data/fix/linux/debian-cve-2026-35091.md) | Apr 1, 2026 |
| Linux | corosync Debian 14 | 3.1.10-2 | [DEBIAN-CVE-2026-35091](https://patchblox.com/security/data/fix/linux/debian-cve-2026-35091.md) | Apr 1, 2026 |
| Linux | corosync RHEL 10 | 3.1.9-1.el10_0.2 | [RHSA-2026:14205](https://patchblox.com/security/data/fix/linux/rhsa-2026-14205.md) | Apr 1, 2026 |
| Linux | corosync RHEL 8 | 0:3.1.8-1.el8_10.1 | [RHSA-2026:13657](https://patchblox.com/security/data/fix/linux/rhsa-2026-13657.md) | May 15, 2026 |
| Linux | corosync RHEL 9 | 0:3.1.10-1.el9_8.1 | [RHSA-2026:19200](https://patchblox.com/security/data/fix/linux/rhsa-2026-19200.md) | May 15, 2026 |
| Linux | corosync Ubuntu 22.04.1 LTS (jammy) | 3.1.6-1ubuntu1.2 | [corosync 3.1.6-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-corosync-3.1.6-1ubuntu1.2.md) | Apr 15, 2026 |
| Linux | corosync Ubuntu 24.04.5 LTS (noble) | 3.1.7-1ubuntu3.2 | [corosync 3.1.7-1ubuntu3.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-corosync-3.1.7-1ubuntu3.2.md) | Apr 15, 2026 |
| Linux | corosync Ubuntu 25.10 (questing) | 3.1.9-2ubuntu1.1 | [corosync 3.1.9-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-corosync-3.1.9-2ubuntu1.1.md) | Apr 15, 2026 |
| Linux | corosync almalinux 10 | 3.1.10-1.el10_2.1 | [ALSA-2026:19043](https://patchblox.com/security/data/fix/linux/alsa-2026-19043.md) | May 19, 2026 |
| Linux | corosync almalinux 8 | 3.1.8-1.el8_10.1 | [ALSA-2026:13657](https://patchblox.com/security/data/fix/linux/alsa-2026-13657.md) | May 5, 2026 |
| Linux | corosync almalinux 9 | 3.1.10-1.el9_8.1 | [ALSA-2026:19200](https://patchblox.com/security/data/fix/linux/alsa-2026-19200.md) | May 19, 2026 |
| Linux | corosync amzn 2023 | 3.1.9-3.amzn2023.0.2 | [ALAS2023-2026-1560](https://patchblox.com/security/data/fix/linux/alas2023-2026-1560.md) | Apr 13, 2026 |
| Linux | corosync ol 10 | 0:3.1.9-2.el10_1.1 | [ELSA-2026-13644](https://patchblox.com/security/data/fix/linux/elsa-2026-13644.md) | May 5, 2026 |
| Linux | corosync ol 8 | 0:3.1.8-1.el8_10.1 | [ELSA-2026-13657](https://patchblox.com/security/data/fix/linux/elsa-2026-13657.md) | May 8, 2026 |
| Linux | corosync ol 9 | 0:3.1.9-2.el9_7.1 | [ELSA-2026-13673](https://patchblox.com/security/data/fix/linux/elsa-2026-13673.md) | May 11, 2026 |
| Linux | corosync opensuse-leap 15.6 | 2.4.6-150300.12.16.1 | [SUSE-SU-2026:1394-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1394-1.md) | Apr 16, 2026 |
| Linux | corosync opensuse-leap 16.0 | 3.1.9-160000.3.1 | [OPENSUSE-SU-2026:20505-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20505-1.md) | Apr 10, 2026 |
| Linux | corosync rocky 10 | 0:3.1.10-1.el10_2.1 | [RLSA-2026:19043](https://patchblox.com/security/data/fix/linux/rlsa-2026-19043.md) | May 29, 2026 |
| Linux | corosync rocky 8 | 0:3.1.8-1.el8_10.1 | [RLSA-2026:13657](https://patchblox.com/security/data/fix/linux/rlsa-2026-13657.md) | May 6, 2026 |
| Linux | corosync rocky 9 | 0:3.1.10-1.el9_8.1 | [RLSA-2026:19200](https://patchblox.com/security/data/fix/linux/rlsa-2026-19200.md) | May 28, 2026 |
| Linux | corosync sles 15.6 | 2.4.6-150300.12.16.1 | [SUSE-SU-2026:1394-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1394-1.md) | Apr 16, 2026 |
| Linux | corosync sles 15.7 | 2.4.6-150300.12.16.1 | [SUSE-SU-2026:1394-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1394-1.md) | Apr 16, 2026 |
| Linux | corosync sles 16.0 | 3.1.9-160000.3.1 | [SUSE-SU-2026:21224-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-21224-1.md) | Apr 10, 2026 |
| Linux | corosync-debuginfo amzn 2023 | 3.1.9-3.amzn2023.0.2 | [ALAS2023-2026-1560](https://patchblox.com/security/data/fix/linux/alas2023-2026-1560.md) | Apr 13, 2026 |
| Linux | corosync-debugsource amzn 2023 | 3.1.9-3.amzn2023.0.2 | [ALAS2023-2026-1560](https://patchblox.com/security/data/fix/linux/alas2023-2026-1560.md) | Apr 13, 2026 |
| Linux | corosync-notifyd Ubuntu 22.04.1 LTS (jammy) | 3.1.6-1ubuntu1.2 | [corosync-notifyd 3.1.6-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-corosync-notifyd-3.1.6-1ubuntu1.2.md) | Apr 15, 2026 |
| Linux | corosync-notifyd Ubuntu 24.04.5 LTS (noble) | 3.1.7-1ubuntu3.2 | [corosync-notifyd 3.1.7-1ubuntu3.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-corosync-notifyd-3.1.7-1ubuntu3.2.md) | Apr 15, 2026 |
| Linux | corosync-notifyd Ubuntu 25.10 (questing) | 3.1.9-2ubuntu1.1 | [corosync-notifyd 3.1.9-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-corosync-notifyd-3.1.9-2ubuntu1.1.md) | Apr 15, 2026 |
| Linux | corosync-vqsim RHEL 8 | 0:3.1.8-1.el8_10.1 | [RHSA-2026:13657](https://patchblox.com/security/data/fix/linux/rhsa-2026-13657.md) | May 15, 2026 |
| Linux | corosync-vqsim RHEL 9 | 0:3.1.10-1.el9_8.1 | [RHSA-2026:19200](https://patchblox.com/security/data/fix/linux/rhsa-2026-19200.md) | May 15, 2026 |
| Linux | corosync-vqsim Ubuntu 22.04.1 LTS (jammy) | 3.1.6-1ubuntu1.2 | [corosync-vqsim 3.1.6-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-corosync-vqsim-3.1.6-1ubuntu1.2.md) | Apr 15, 2026 |
| Linux | corosync-vqsim Ubuntu 24.04.5 LTS (noble) | 3.1.7-1ubuntu3.2 | [corosync-vqsim 3.1.7-1ubuntu3.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-corosync-vqsim-3.1.7-1ubuntu3.2.md) | Apr 15, 2026 |
| Linux | corosync-vqsim Ubuntu 25.10 (questing) | 3.1.9-2ubuntu1.1 | [corosync-vqsim 3.1.9-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-corosync-vqsim-3.1.9-2ubuntu1.1.md) | Apr 15, 2026 |
| Linux | corosync-vqsim almalinux 10 | 3.1.10-1.el10_2.1 | [ALSA-2026:19043](https://patchblox.com/security/data/fix/linux/alsa-2026-19043.md) | May 19, 2026 |
| Linux | corosync-vqsim almalinux 8 | 3.1.8-1.el8_10.1 | [ALSA-2026:13657](https://patchblox.com/security/data/fix/linux/alsa-2026-13657.md) | May 5, 2026 |
| Linux | corosync-vqsim almalinux 9 | 3.1.10-1.el9_8.1 | [ALSA-2026:19200](https://patchblox.com/security/data/fix/linux/alsa-2026-19200.md) | May 19, 2026 |
| Linux | corosync-vqsim amzn 2023 | 3.1.9-3.amzn2023.0.2 | [ALAS2023-2026-1560](https://patchblox.com/security/data/fix/linux/alas2023-2026-1560.md) | Apr 13, 2026 |
| Linux | corosync-vqsim ol 10 | 0:3.1.9-2.el10_1.1 | [ELSA-2026-13644](https://patchblox.com/security/data/fix/linux/elsa-2026-13644.md) | May 5, 2026 |
| Linux | corosync-vqsim ol 8 | 0:3.1.8-1.el8_10.1 | [ELSA-2026-13657](https://patchblox.com/security/data/fix/linux/elsa-2026-13657.md) | May 8, 2026 |
| Linux | corosync-vqsim ol 9 | 0:3.1.9-2.el9_7.1 | [ELSA-2026-13673](https://patchblox.com/security/data/fix/linux/elsa-2026-13673.md) | May 11, 2026 |
| Linux | corosync-vqsim-debuginfo amzn 2023 | 3.1.9-3.amzn2023.0.2 | [ALAS2023-2026-1560](https://patchblox.com/security/data/fix/linux/alas2023-2026-1560.md) | Apr 13, 2026 |
| Linux | corosynclib RHEL 8 | 0:3.1.8-1.el8_10.1 | [RHSA-2026:13657](https://patchblox.com/security/data/fix/linux/rhsa-2026-13657.md) | May 15, 2026 |
| Linux | corosynclib RHEL 9 | 0:3.1.10-1.el9_8.1 | [RHSA-2026:19200](https://patchblox.com/security/data/fix/linux/rhsa-2026-19200.md) | May 15, 2026 |
| Linux | corosynclib almalinux 10 | 3.1.10-1.el10_2.1 | [ALSA-2026:19043](https://patchblox.com/security/data/fix/linux/alsa-2026-19043.md) | May 19, 2026 |
| Linux | corosynclib almalinux 8 | 3.1.8-1.el8_10.1 | [ALSA-2026:13657](https://patchblox.com/security/data/fix/linux/alsa-2026-13657.md) | May 5, 2026 |
| Linux | corosynclib almalinux 9 | 3.1.10-1.el9_8.1 | [ALSA-2026:19200](https://patchblox.com/security/data/fix/linux/alsa-2026-19200.md) | May 19, 2026 |
| Linux | corosynclib amzn 2023 | 3.1.9-3.amzn2023.0.2 | [ALAS2023-2026-1560](https://patchblox.com/security/data/fix/linux/alas2023-2026-1560.md) | Apr 13, 2026 |
| Linux | corosynclib ol 10 | 0:3.1.9-2.el10_1.1 | [ELSA-2026-13644](https://patchblox.com/security/data/fix/linux/elsa-2026-13644.md) | May 5, 2026 |
| Linux | corosynclib ol 8 | 0:3.1.8-1.el8_10.1 | [ELSA-2026-13657](https://patchblox.com/security/data/fix/linux/elsa-2026-13657.md) | May 8, 2026 |
| Linux | corosynclib ol 9 | 0:3.1.9-2.el9_7.1 | [ELSA-2026-13673](https://patchblox.com/security/data/fix/linux/elsa-2026-13673.md) | May 11, 2026 |
| Linux | corosynclib-debuginfo amzn 2023 | 3.1.9-3.amzn2023.0.2 | [ALAS2023-2026-1560](https://patchblox.com/security/data/fix/linux/alas2023-2026-1560.md) | Apr 13, 2026 |
| Linux | corosynclib-devel RHEL 8 | 0:3.1.8-1.el8_10.1 | [RHSA-2026:13657](https://patchblox.com/security/data/fix/linux/rhsa-2026-13657.md) | May 15, 2026 |
| Linux | corosynclib-devel RHEL 9 | 0:3.1.10-1.el9_8.1 | [RHSA-2026:19200](https://patchblox.com/security/data/fix/linux/rhsa-2026-19200.md) | May 15, 2026 |
| Linux | corosynclib-devel almalinux 10 | 3.1.10-1.el10_2.1 | [ALSA-2026:19043](https://patchblox.com/security/data/fix/linux/alsa-2026-19043.md) | May 19, 2026 |
| Linux | corosynclib-devel almalinux 8 | 3.1.8-1.el8_10.1 | [ALSA-2026:13657](https://patchblox.com/security/data/fix/linux/alsa-2026-13657.md) | May 5, 2026 |
| Linux | corosynclib-devel almalinux 9 | 3.1.10-1.el9_8.1 | [ALSA-2026:19200](https://patchblox.com/security/data/fix/linux/alsa-2026-19200.md) | May 19, 2026 |
| Linux | corosynclib-devel amzn 2023 | 3.1.9-3.amzn2023.0.2 | [ALAS2023-2026-1560](https://patchblox.com/security/data/fix/linux/alas2023-2026-1560.md) | Apr 13, 2026 |
| Linux | libcfg7 Ubuntu 22.04.1 LTS (jammy) | 3.1.6-1ubuntu1.2 | [libcfg7 3.1.6-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libcfg7-3.1.6-1ubuntu1.2.md) | Apr 15, 2026 |
| Linux | libcfg7 Ubuntu 24.04.5 LTS (noble) | 3.1.7-1ubuntu3.2 | [libcfg7 3.1.7-1ubuntu3.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libcfg7-3.1.7-1ubuntu3.2.md) | Apr 15, 2026 |
| Linux | libcfg7 Ubuntu 25.10 (questing) | 3.1.9-2ubuntu1.1 | [libcfg7 3.1.9-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libcfg7-3.1.9-2ubuntu1.1.md) | Apr 15, 2026 |
| Linux | libcmap4 Ubuntu 22.04.1 LTS (jammy) | 3.1.6-1ubuntu1.2 | [libcmap4 3.1.6-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libcmap4-3.1.6-1ubuntu1.2.md) | Apr 15, 2026 |
| Linux | libcmap4 Ubuntu 24.04.5 LTS (noble) | 3.1.7-1ubuntu3.2 | [libcmap4 3.1.7-1ubuntu3.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libcmap4-3.1.7-1ubuntu3.2.md) | Apr 15, 2026 |
| Linux | libcmap4 Ubuntu 25.10 (questing) | 3.1.9-2ubuntu1.1 | [libcmap4 3.1.9-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libcmap4-3.1.9-2ubuntu1.1.md) | Apr 15, 2026 |
| Linux | libcorosync-common4 Ubuntu 22.04.1 LTS (jammy) | 3.1.6-1ubuntu1.2 | [libcorosync-common4 3.1.6-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libcorosync-common4-3.1.6-1ubuntu1.2.md) | Apr 15, 2026 |
| Linux | libcorosync-common4 Ubuntu 24.04.5 LTS (noble) | 3.1.7-1ubuntu3.2 | [libcorosync-common4 3.1.7-1ubuntu3.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libcorosync-common4-3.1.7-1ubuntu3.2.md) | Apr 15, 2026 |
| Linux | libcorosync-common4 Ubuntu 25.10 (questing) | 3.1.9-2ubuntu1.1 | [libcorosync-common4 3.1.9-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libcorosync-common4-3.1.9-2ubuntu1.1.md) | Apr 15, 2026 |
| Linux | libcpg4 Ubuntu 22.04.1 LTS (jammy) | 3.1.6-1ubuntu1.2 | [libcpg4 3.1.6-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libcpg4-3.1.6-1ubuntu1.2.md) | Apr 15, 2026 |
| Linux | libcpg4 Ubuntu 24.04.5 LTS (noble) | 3.1.7-1ubuntu3.2 | [libcpg4 3.1.7-1ubuntu3.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libcpg4-3.1.7-1ubuntu3.2.md) | Apr 15, 2026 |
| Linux | libcpg4 Ubuntu 25.10 (questing) | 3.1.9-2ubuntu1.1 | [libcpg4 3.1.9-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libcpg4-3.1.9-2ubuntu1.1.md) | Apr 15, 2026 |
| Linux | libquorum5 Ubuntu 22.04.1 LTS (jammy) | 3.1.6-1ubuntu1.2 | [libquorum5 3.1.6-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libquorum5-3.1.6-1ubuntu1.2.md) | Apr 15, 2026 |
| Linux | libquorum5 Ubuntu 24.04.5 LTS (noble) | 3.1.7-1ubuntu3.2 | [libquorum5 3.1.7-1ubuntu3.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libquorum5-3.1.7-1ubuntu3.2.md) | Apr 15, 2026 |
| Linux | libquorum5 Ubuntu 25.10 (questing) | 3.1.9-2ubuntu1.1 | [libquorum5 3.1.9-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libquorum5-3.1.9-2ubuntu1.1.md) | Apr 15, 2026 |
| Linux | libsam4 Ubuntu 22.04.1 LTS (jammy) | 3.1.6-1ubuntu1.2 | [libsam4 3.1.6-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libsam4-3.1.6-1ubuntu1.2.md) | Apr 15, 2026 |
| Linux | libsam4 Ubuntu 24.04.5 LTS (noble) | 3.1.7-1ubuntu3.2 | [libsam4 3.1.7-1ubuntu3.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libsam4-3.1.7-1ubuntu3.2.md) | Apr 15, 2026 |
| Linux | libsam4 Ubuntu 25.10 (questing) | 3.1.9-2ubuntu1.1 | [libsam4 3.1.9-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libsam4-3.1.9-2ubuntu1.1.md) | Apr 15, 2026 |
| Linux | libvotequorum8 Ubuntu 22.04.1 LTS (jammy) | 3.1.6-1ubuntu1.2 | [libvotequorum8 3.1.6-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libvotequorum8-3.1.6-1ubuntu1.2.md) | Apr 15, 2026 |
| Linux | libvotequorum8 Ubuntu 24.04.5 LTS (noble) | 3.1.7-1ubuntu3.2 | [libvotequorum8 3.1.7-1ubuntu3.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libvotequorum8-3.1.7-1ubuntu3.2.md) | Apr 15, 2026 |
| Linux | libvotequorum8 Ubuntu 25.10 (questing) | 3.1.9-2ubuntu1.1 | [libvotequorum8 3.1.9-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libvotequorum8-3.1.9-2ubuntu1.1.md) | Apr 15, 2026 |
| Linux | spausedd RHEL 8 | 0:3.1.8-1.el8_10.1 | [RHSA-2026:13657](https://patchblox.com/security/data/fix/linux/rhsa-2026-13657.md) | May 15, 2026 |
| Linux | spausedd almalinux 8 | 3.1.8-1.el8_10.1 | [ALSA-2026:13657](https://patchblox.com/security/data/fix/linux/alsa-2026-13657.md) | May 5, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.