Home / mailings

PDF

[USN-8170-1] Corosync vulnerabilities

Posted on 13 April 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8170-1
April 13, 2026

corosync vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in Corosync.

Software Description:
- corosync: cluster engine daemon and utilities

Details:

It was discovered that Corosync incorrectly handled the membership commit
token validity check. A remote attacker could use this issue to cause
Corosync to crash, resulting in a denial of service, or to possibly obtain
a small quantity of sensitive information. (CVE-2026-35091)

It was discovered that Corosync incorrectly handled join message
validation. A remote attacker could possibly use this issue to cause
Corosync to crash, resulting in a denial of service. (CVE-2026-35092)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
corosync 3.1.9-2ubuntu1.1

Ubuntu 24.04 LTS
corosync 3.1.7-1ubuntu3.2

Ubuntu 22.04 LTS
corosync 3.1.6-1ubuntu1.2

After a standard system update you need to restart Corosync to make all the
necessary changes.

References:
https://ubuntu.com/security/notices/USN-8170-1
CVE-2026-35091, CVE-2026-35092

Package Information:
https://launchpad.net/ubuntu/+source/corosync/3.1.9-2ubuntu1.1
https://launchpad.net/ubuntu/+source/corosync/3.1.7-1ubuntu3.2
https://launchpad.net/ubuntu/+source/corosync/3.1.6-1ubuntu1.2

--===============7275342854206145195==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP