Description
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
Published: 2026-09-04
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An integer overflow in Corosync’s calculation of the expected membership commit token message length can bypass the message-length validation on 32‑bit systems. A crafted packet crafted to exploit this overflow triggers an out‑of‑bounds memory access that crashes the Corosync daemon, causing the affected cluster node to stop responding to requests.

Affected Systems

The flaw is present in Red Hat Enterprise Linux 10, 7, 8, and 9, as well as Red Hat OpenShift Container Platform 4. The vulnerability only affects 32‑bit deployments; on 64‑bit systems the length calculation is performed with 64‑bit arithmetic and the overflow does not occur.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers with network access to the cluster communication ports (5405‑5412/UDP) may send a malicious membership commit token message; the likely attack vector is network‑based intrusion to the cluster nodes. Exploitation would result in a denial of service on the targeted node, potentially disrupting cluster availability.

Generated by OpenCVE AI on September 4, 2026 at 11:24 UTC.

Remediation

Vendor Workaround

There is no complete mitigation for this vulnerability short of a fix, but the following steps reduce risk: 1. Ensure cluster message authentication is enabled in corosync.conf (crypto_cipher=aes256, crypto_hash=sha256 with a shared key from corosync-keygen), which is the default when clusters are configured via 'pcs cluster setup', and disabling it (cipher=none/hash=none) is an explicitly unsupported configuration per upstream maintainer guidance. 2. Restrict network access to the cluster communication ports (default 5405-5412/UDP) to trusted cluster node addresses only. 3. Where architecturally feasible, prefer 64-bit deployments, since the integer overflow described here does not occur on 64-bit systems.

OpenCVE Recommended Actions

  • Enable cluster message authentication in corosync.conf by specifying crypto_cipher=aes256 and crypto_hash=sha256 with a shared key, which is the default when clusters are configured with pcs cluster setup.
  • Restrict traffic on the default cluster communication ports (5405‑5412/UDP) to only trusted node IP addresses, preventing unauthorized nodes from sending malformed messages.
  • Where possible, deploy 64‑bit operating systems, as the integer overflow does not occur on 64‑bit architectures.

Generated by OpenCVE AI on September 4, 2026 at 11:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Corosync
Corosync corosync
Redhat openshift Container Platform
Vendors & Products Corosync
Corosync corosync
Redhat openshift Container Platform

Fri, 04 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 04 Sep 2026 10:00:00 +0000

Type Values Removed Values Added
Description An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
Title Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-190
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Corosync Corosync
Redhat Enterprise Linux Openshift Openshift Container Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-04T09:46:06.130Z

Reserved: 2026-08-27T10:38:28.793Z

Link: CVE-2026-81666

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T10:17:13.187

Modified: 2026-09-04T10:17:13.187

Link: CVE-2026-81666

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-04T08:14:29Z

Links: CVE-2026-81666 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T15:20:11Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound