Corosync contains an integer overflow in the validation of join messages. An unauthenticated, remote attacker can send specially crafted UDP packets to the Corosync service, which can trigger an overflow and cause the process to crash. The result is an interruption of the cluster service, leading to denial of service for the affected nodes. The flaw is specific to deployments that use the totemudp or totemudpu networking mode.

The vulnerability affects Red Hat Enterprise Linux releases 10, 7, 8, 9 and Red Hat OpenShift Container Platform 4. Any operating system or platform that hosts Corosync with the affected networking mode and has exposed the default port (5405) to a network that can be reached by unauthenticated hosts is susceptible. No specific patch version information was included in the data, so all versions of these products that have Corosync running in the described mode should be considered vulnerable.

The CVSS base score of 7.5 indicates a high risk to availability. With no EPSS data available, the probability of exploitation cannot be quantified, but the flaw permits a simple, unauthenticated, remote attack via UDP to port 5405. ability to crash the cluster service without authentication makes this vulnerability easily exploitable in environments where Corosync is exposed to untrusted networks. Because it is not listed in the CISA KEV catalog, there is no evidence yet of widespread exploitation, yet the potential impact on cluster availability warrants prompt action.