CVE-2026-35091

{"id": "CVE-2026-35091", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35091", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T20:28:59.762709Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:3.1.9-2.el10_1.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:3.1.10-1.el10_2.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:3.1.9-1.el10_0.2", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7::server"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "versions": [{"status": "unaffected", "version": "0:2.4.5-7.el7_9.3", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/a:redhat:enterprise_linux:8::crb", "cpe:/a:redhat:enterprise_linux:8::highavailability", "cpe:/a:redhat:enterprise_linux:8::resilientstorage"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "0:3.1.8-1.el8_10.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_aus:8.4::highavailability", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "versions": [{"status": "unaffected", "version": "0:3.1.0-3.el8_4.2", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_aus:8.4::highavailability", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "versions": [{"status": "unaffected", "version": "0:3.1.0-3.el8_4.2", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::highavailability", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::highavailability"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "versions": [{"status": "unaffected", "version": "0:3.1.5-2.el8_6.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::highavailability", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::highavailability"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "versions": [{"status": "unaffected", "version": "0:3.1.5-2.el8_6.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::highavailability", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::highavailability"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.1.5-2.el8_6.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_e4s:8.8::highavailability", "cpe:/a:redhat:rhel_tus:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::highavailability"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "versions": [{"status": "unaffected", "version": "0:3.1.7-1.el8_8.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_e4s:8.8::highavailability", "cpe:/a:redhat:rhel_tus:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::highavailability"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.1.7-1.el8_8.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/a:redhat:enterprise_linux:9::highavailability", "cpe:/a:redhat:enterprise_linux:9::resilientstorage"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:3.1.9-2.el9_7.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/a:redhat:enterprise_linux:9::highavailability", "cpe:/a:redhat:enterprise_linux:9::resilientstorage"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:3.1.10-1.el9_8.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.0::appstream", "cpe:/a:redhat:rhel_e4s:9.0::highavailability", "cpe:/a:redhat:rhel_e4s:9.0::resilientstorage"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.1.5-3.el9_0.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.2::appstream", "cpe:/a:redhat:rhel_e4s:9.2::highavailability", "cpe:/a:redhat:rhel_e4s:9.2::resilientstorage"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.1.7-1.el9_2.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.4::appstream", "cpe:/a:redhat:rhel_eus:9.4::crb", "cpe:/a:redhat:rhel_eus:9.4::highavailability", "cpe:/a:redhat:rhel_eus:9.4::resilientstorage"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:3.1.8-1.el9_4.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.6::appstream", "cpe:/a:redhat:rhel_eus:9.6::crb", "cpe:/a:redhat:rhel_eus:9.6::highavailability", "cpe:/a:redhat:rhel_eus:9.6::resilientstorage"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:3.1.9-2.el9_6.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "corosync", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-04-01T14:16:57.040", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:13644", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:13657", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:13673", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:14205", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:14210", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:14211", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:14212", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:14213", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:14214", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:14215", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:14216", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:19043", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:19200", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:20916", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-35091", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453169", "tags": ["Exploit", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453813", "tags": ["Issue Tracking"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-253"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents"}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en Corosync. Un atacante remoto no autenticado puede explotar una vulnerabilidad de valor de retorno incorrecto en la comprobaci\u00f3n de integridad del token de confirmaci\u00f3n de membres\u00eda de Corosync enviando un paquete de User Datagram Protocol (UDP) especialmente dise\u00f1ado. Esto puede llevar a una lectura fuera de l\u00edmites, causando una denegaci\u00f3n de servicio (DoS) y potencialmente revelando contenido limitado de la memoria. Esta vulnerabilidad afecta a Corosync cuando se ejecuta en modo totemudp/totemudpu, que es la configuraci\u00f3n predeterminada."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:corosync:corosync:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5008766D-B12C-48F2-A70A-2344860259C2"}, {"criteria": "cpe:2.3:a:redhat:openshift:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F7E2F04-474D-4196-9CE8-242642990A16"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}