Back Linuxsecurity

Fedora 42 Corosync Critical DoS Threats CVE-2026-35091 CVE-2026

Linuxsecurity •LinuxSecurity Advisories • April 12, 2026

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script. Update Information : Security fix for CVE-2026-35091 and CVE-2026-35092

This package contains the Corosync Cluster Engine Executive, several default

APIs and libraries, default configuration files, and an init script.

Security fix for CVE-2026-35091 and CVE-2026-35092

* Thu Apr 2 2026 Jan Friesse - 3.1.9-4 - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091) - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092)

[ 1 ] Bug #2453169 - corosync: pre-auth OOB read in check_memb_commit_token_sanity + integer overflow in check_memb_join_sanity [ 2 ] Bug #2453815 - CVE-2026-35091 corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet [fedora-all] [ 3 ] Bug #2453821 - CVE-2026-35092 corosync: Corosync: Denial of Service via integer overflow in join message validation [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-95ee0edcd5' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Corosync Vulnerabilities Discovered in Ubuntu and Fedora Multiple vulnerabilities have been identified in the Corosync cluster engine, affecting Ubuntu 25.10, 24.04 LTS, and 22.04 LTS, as well as Fedora 42. The vulnerabilities include improper handling of membership commit token validity checks (CVE-2026-35091) and join message validation (CVE-2026-35092). A remote attacker could exploit these issues to crash Corosync, leading to denial of service, and potentially disclose sensitive information. The vulnerabilities were published on April 1, 2026, and have been addressed in recent updates. Users are advised to update their systems and restart Corosync to apply the patches. The affected versions of Corosync include 3.1.9-2ubuntu1.1 for Ubuntu 25.10 and 3.1.9-4 for Fedora. The updates are crucial for maintaining system integrity and availability. 3 sources 71

Extracted Entities

Fedora 42 Corosync Critical DoS Threats CVE-2026-35091 CVE-2026

The full story

Extracted Entities

Attack Types (2)

Companies (1)

CVEs (2)

MITRE ATT&CK (1)

Platforms (1)