cvelistv5 - cve-2026-35091

CVE-2026-35091 (GCVE-0-2026-35091)

Vulnerability from cvelistv5

Published

2026-04-01 13:18

Modified

2026-08-21 12:15

Severity ?

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CWE

CWE-253 - Incorrect Check of Function Return Value

Summary

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents

References

URL

Tags

	https://access.redhat.com/errata/RHSA-2026:13644	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:13657	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:13673	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:14205	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:14210	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:14211	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:14212	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:14213	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:14214	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:14215	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:14216	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:19043	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:19200	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:20916	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2026-35091	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2453169
	https://bugzilla.redhat.com/show_bug.cgi?id=2453813	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

Red Hat

Red Hat Enterprise Linux 10

Unaffected: 0:3.1.9-2.el10_1.1 < *
cpe:/o:redhat:enterprise_linux:10.1

Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.1.10-1.el10_2.1 < * cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:3.1.9-1.el10_0.2 < * cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:2.4.5-7.el7_9.3 < * cpe:/o:redhat:enterprise_linux:7::server
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.1.8-1.el8_10.1 < * cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb cpe:/a:redhat:enterprise_linux:8::highavailability cpe:/a:redhat:enterprise_linux:8::resilientstorage
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:3.1.0-3.el8_4.2 < * cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::highavailability cpe:/a:redhat:rhel_eus_long_life:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:3.1.0-3.el8_4.2 < * cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::highavailability cpe:/a:redhat:rhel_eus_long_life:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:3.1.5-2.el8_6.1 < * cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::highavailability cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::highavailability
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:3.1.5-2.el8_6.1 < * cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::highavailability cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::highavailability
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:3.1.5-2.el8_6.1 < * cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::highavailability cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::highavailability
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:3.1.7-1.el8_8.1 < * cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_e4s:8.8::highavailability cpe:/a:redhat:rhel_tus:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::highavailability
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:3.1.7-1.el8_8.1 < * cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_e4s:8.8::highavailability cpe:/a:redhat:rhel_tus:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::highavailability
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.1.9-2.el9_7.1 < * cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb cpe:/a:redhat:enterprise_linux:9::highavailability cpe:/a:redhat:enterprise_linux:9::resilientstorage
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.1.10-1.el9_8.1 < * cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb cpe:/a:redhat:enterprise_linux:9::highavailability cpe:/a:redhat:enterprise_linux:9::resilientstorage
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:3.1.5-3.el9_0.1 < * cpe:/a:redhat:rhel_e4s:9.0::appstream cpe:/a:redhat:rhel_e4s:9.0::highavailability cpe:/a:redhat:rhel_e4s:9.0::resilientstorage
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:3.1.7-1.el9_2.1 < * cpe:/a:redhat:rhel_e4s:9.2::appstream cpe:/a:redhat:rhel_e4s:9.2::highavailability cpe:/a:redhat:rhel_e4s:9.2::resilientstorage
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:3.1.8-1.el9_4.1 < * cpe:/a:redhat:rhel_eus:9.4::appstream cpe:/a:redhat:rhel_eus:9.4::crb cpe:/a:redhat:rhel_eus:9.4::highavailability cpe:/a:redhat:rhel_eus:9.4::resilientstorage
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:3.1.9-2.el9_6.1 < * cpe:/a:redhat:rhel_eus:9.6::appstream cpe:/a:redhat:rhel_eus:9.6::crb cpe:/a:redhat:rhel_eus:9.6::highavailability cpe:/a:redhat:rhel_eus:9.6::resilientstorage
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-35091",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T20:28:59.762709Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T20:29:55.615Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.1"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.9-2.el10_1.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.10-1.el10_2.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux_eus:10.0"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.9-1.el10_0.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7::server"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.4.5-7.el7_9.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb",
            "cpe:/a:redhat:enterprise_linux:8::highavailability",
            "cpe:/a:redhat:enterprise_linux:8::resilientstorage"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.8-1.el8_10.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::highavailability",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.0-3.el8_4.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::highavailability",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.0-3.el8_4.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::highavailability",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::highavailability"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.5-2.el8_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::highavailability",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::highavailability"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.5-2.el8_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::highavailability",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::highavailability"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.5-2.el8_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_e4s:8.8::highavailability",
            "cpe:/a:redhat:rhel_tus:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::highavailability"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.7-1.el8_8.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_e4s:8.8::highavailability",
            "cpe:/a:redhat:rhel_tus:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::highavailability"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.7-1.el8_8.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb",
            "cpe:/a:redhat:enterprise_linux:9::highavailability",
            "cpe:/a:redhat:enterprise_linux:9::resilientstorage"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.9-2.el9_7.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb",
            "cpe:/a:redhat:enterprise_linux:9::highavailability",
            "cpe:/a:redhat:enterprise_linux:9::resilientstorage"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.10-1.el9_8.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream",
            "cpe:/a:redhat:rhel_e4s:9.0::highavailability",
            "cpe:/a:redhat:rhel_e4s:9.0::resilientstorage"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.5-3.el9_0.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream",
            "cpe:/a:redhat:rhel_e4s:9.2::highavailability",
            "cpe:/a:redhat:rhel_e4s:9.2::resilientstorage"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.7-1.el9_2.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream",
            "cpe:/a:redhat:rhel_eus:9.4::crb",
            "cpe:/a:redhat:rhel_eus:9.4::highavailability",
            "cpe:/a:redhat:rhel_eus:9.4::resilientstorage"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.8-1.el9_4.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream",
            "cpe:/a:redhat:rhel_eus:9.6::crb",
            "cpe:/a:redhat:rhel_eus:9.6::highavailability",
            "cpe:/a:redhat:rhel_eus:9.6::resilientstorage"
          ],
          "defaultStatus": "affected",
          "packageName": "corosync",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.1.9-2.el9_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Sebasti\u00e1n Alba Vives for reporting this issue."
        }
      ],
      "datePublic": "2026-04-01T11:48:13.254Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-253",
              "description": "Incorrect Check of Function Return Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T12:15:34.109Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:13644",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:13644"
        },
        {
          "name": "RHSA-2026:13657",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:13657"
        },
        {
          "name": "RHSA-2026:13673",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:13673"
        },
        {
          "name": "RHSA-2026:14205",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:14205"
        },
        {
          "name": "RHSA-2026:14210",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:14210"
        },
        {
          "name": "RHSA-2026:14211",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:14211"
        },
        {
          "name": "RHSA-2026:14212",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:14212"
        },
        {
          "name": "RHSA-2026:14213",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:14213"
        },
        {
          "name": "RHSA-2026:14214",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:14214"
        },
        {
          "name": "RHSA-2026:14215",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:14215"
        },
        {
          "name": "RHSA-2026:14216",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:14216"
        },
        {
          "name": "RHSA-2026:19043",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19043"
        },
        {
          "name": "RHSA-2026:19200",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19200"
        },
        {
          "name": "RHSA-2026:20916",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:20916"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-35091"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453169"
        },
        {
          "name": "RHBZ#2453813",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453813"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-01T11:31:01.742Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-04-01T11:48:13.254Z",
          "value": "Made public."
        }
      ],
      "title": "Corosync: corosync: denial of service and information disclosure via crafted udp packet",
      "workarounds": [
        {
          "lang": "en",
          "value": "Systems using totemudp or totemudpu should migrate to the supported knet transport and enable encryption.\n\nDisabling the Corosync service is a valid workaround if clustering is not required, but for active clusters, enabling encryption via knet is the preferred and recommended approach."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-253: Incorrect Check of Function Return Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-35091",
    "datePublished": "2026-04-01T13:18:53.738Z",
    "dateReserved": "2026-04-01T11:35:23.145Z",
    "dateUpdated": "2026-08-21T12:15:34.109Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-35091\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-01T20:28:59.762709Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-01T20:29:29.178Z\"}}], \"cna\": {\"title\": \"Corosync: corosync: denial of service and information disclosure via crafted udp packet\", \"credits\": [{\"lang\": \"en\", \"value\": \"Red Hat would like to thank Sebasti\\u00e1n Alba Vives for reporting this issue.\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.9-2.el10_1.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.10-1.el10_2.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux_eus:10.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10.0 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.9-1.el10_0.2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7::server\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7 Extended Lifecycle Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.4.5-7.el7_9.3\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\", \"cpe:/a:redhat:enterprise_linux:8::crb\", \"cpe:/a:redhat:enterprise_linux:8::highavailability\", \"cpe:/a:redhat:enterprise_linux:8::resilientstorage\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.8-1.el8_10.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.4::appstream\", \"cpe:/a:redhat:rhel_aus:8.4::highavailability\", \"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\", \"cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.0-3.el8_4.2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.4::appstream\", \"cpe:/a:redhat:rhel_aus:8.4::highavailability\", \"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\", \"cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.0-3.el8_4.2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.6::appstream\", \"cpe:/a:redhat:rhel_e4s:8.6::appstream\", \"cpe:/a:redhat:rhel_e4s:8.6::highavailability\", \"cpe:/a:redhat:rhel_tus:8.6::appstream\", \"cpe:/a:redhat:rhel_tus:8.6::highavailability\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.5-2.el8_6.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.6::appstream\", \"cpe:/a:redhat:rhel_e4s:8.6::appstream\", \"cpe:/a:redhat:rhel_e4s:8.6::highavailability\", \"cpe:/a:redhat:rhel_tus:8.6::appstream\", \"cpe:/a:redhat:rhel_tus:8.6::highavailability\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.6 Telecommunications Update Service\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.5-2.el8_6.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.6::appstream\", \"cpe:/a:redhat:rhel_e4s:8.6::appstream\", \"cpe:/a:redhat:rhel_e4s:8.6::highavailability\", \"cpe:/a:redhat:rhel_tus:8.6::appstream\", \"cpe:/a:redhat:rhel_tus:8.6::highavailability\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.5-2.el8_6.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.8::appstream\", \"cpe:/a:redhat:rhel_e4s:8.8::highavailability\", \"cpe:/a:redhat:rhel_tus:8.8::appstream\", \"cpe:/a:redhat:rhel_tus:8.8::highavailability\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.8 Telecommunications Update Service\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.7-1.el8_8.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.8::appstream\", \"cpe:/a:redhat:rhel_e4s:8.8::highavailability\", \"cpe:/a:redhat:rhel_tus:8.8::appstream\", \"cpe:/a:redhat:rhel_tus:8.8::highavailability\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.7-1.el8_8.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\", \"cpe:/a:redhat:enterprise_linux:9::crb\", \"cpe:/a:redhat:enterprise_linux:9::highavailability\", \"cpe:/a:redhat:enterprise_linux:9::resilientstorage\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.9-2.el9_7.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\", \"cpe:/a:redhat:enterprise_linux:9::crb\", \"cpe:/a:redhat:enterprise_linux:9::highavailability\", \"cpe:/a:redhat:enterprise_linux:9::resilientstorage\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.10-1.el9_8.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.0::appstream\", \"cpe:/a:redhat:rhel_e4s:9.0::highavailability\", \"cpe:/a:redhat:rhel_e4s:9.0::resilientstorage\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.5-3.el9_0.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.2::appstream\", \"cpe:/a:redhat:rhel_e4s:9.2::highavailability\", \"cpe:/a:redhat:rhel_e4s:9.2::resilientstorage\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.7-1.el9_2.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.4::appstream\", \"cpe:/a:redhat:rhel_eus:9.4::crb\", \"cpe:/a:redhat:rhel_eus:9.4::highavailability\", \"cpe:/a:redhat:rhel_eus:9.4::resilientstorage\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.4 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.8-1.el9_4.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.6::appstream\", \"cpe:/a:redhat:rhel_eus:9.6::crb\", \"cpe:/a:redhat:rhel_eus:9.6::highavailability\", \"cpe:/a:redhat:rhel_eus:9.6::resilientstorage\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.6 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.1.9-2.el9_6.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"corosync\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift/ose-rhel-coreos-9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-01T11:31:01.742Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-04-01T11:48:13.254Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-04-01T11:48:13.254Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2026:13644\", \"name\": \"RHSA-2026:13644\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13657\", \"name\": \"RHSA-2026:13657\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13673\", \"name\": \"RHSA-2026:13673\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14205\", \"name\": \"RHSA-2026:14205\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14210\", \"name\": \"RHSA-2026:14210\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14211\", \"name\": \"RHSA-2026:14211\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14212\", \"name\": \"RHSA-2026:14212\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14213\", \"name\": \"RHSA-2026:14213\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14214\", \"name\": \"RHSA-2026:14214\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14215\", \"name\": \"RHSA-2026:14215\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14216\", \"name\": \"RHSA-2026:14216\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19043\", \"name\": \"RHSA-2026:19043\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19200\", \"name\": \"RHSA-2026:19200\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20916\", \"name\": \"RHSA-2026:20916\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2026-35091\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2453169\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2453813\", \"name\": \"RHBZ#2453813\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Systems using totemudp or totemudpu should migrate to the supported knet transport and enable encryption.\\n\\nDisabling the Corosync service is a valid workaround if clustering is not required, but for active clusters, enabling encryption via knet is the preferred and recommended approach.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-253\", \"description\": \"Incorrect Check of Function Return Value\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-08-21T12:15:34.109Z\"}, \"x_redhatCweChain\": \"CWE-253: Incorrect Check of Function Return Value\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-35091\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-21T12:15:34.109Z\", \"dateReserved\": \"2026-04-01T11:35:23.145Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-04-01T13:18:53.738Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-1032

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
IBM	WebSphere	WebSphere Application Server versions 9.x antérieures à 9.0.5.29
IBM	WebSphere	WebSphere Application Server Liberty versions antérieures à 26.0.0.9
IBM	QRadar	QRadar App SDK versions antérieures à 2.2.6
IBM	Db2	Db2 version 12.1 sans les derniers correctifs de sécurité
IBM	Db2	Db2 versions 11.5 sans les derniers correctifs de sécurité
IBM	WebSphere	WebSphere eXtreme Scale versions 8.6.2.x antérieures à 8.6.2.2 et sans le correctif PH72363 iFix
IBM	WebSphere	WebSphere Service Registry and Repository Studio versions antérieures à V8.5.6.3_IJ59344

References

Title

Publication Time

Tags

Bulletin de sécurité IBM 7283290	2026-08-11	vendor-advisory
Bulletin de sécurité IBM 7282872	2026-08-07	vendor-advisory
Bulletin de sécurité IBM 7283489	2026-08-12	vendor-advisory
Bulletin de sécurité IBM 7282868	2026-08-10	vendor-advisory
Bulletin de sécurité IBM 7283567	2026-08-12	vendor-advisory
Bulletin de sécurité IBM 7282947	2026-08-07	vendor-advisory
Bulletin de sécurité IBM 7282946	2026-08-07	vendor-advisory
Bulletin de sécurité IBM 7282949	2026-08-07	vendor-advisory
Bulletin de sécurité IBM 7277422	2026-08-12	vendor-advisory
Bulletin de sécurité IBM 7283488	2026-08-12	vendor-advisory
Bulletin de sécurité IBM 7279461	2026-08-07	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "WebSphere Application Server versions 9.x ant\u00e9rieures \u00e0 9.0.5.29",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Application Server Liberty versions ant\u00e9rieures \u00e0 26.0.0.9",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "QRadar App SDK versions ant\u00e9rieures \u00e0 2.2.6",
      "product": {
        "name": "QRadar",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 version 12.1 sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions 11.5 sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere eXtreme Scale versions 8.6.2.x ant\u00e9rieures \u00e0 8.6.2.2 et sans le correctif PH72363 iFix",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Service Registry and Repository Studio versions ant\u00e9rieures \u00e0 V8.5.6.3_IJ59344",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-5588",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
    },
    {
      "name": "CVE-2026-33871",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33871"
    },
    {
      "name": "CVE-2026-41254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41254"
    },
    {
      "name": "CVE-2026-44405",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44405"
    },
    {
      "name": "CVE-2026-32990",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32990"
    },
    {
      "name": "CVE-2026-50645",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50645"
    },
    {
      "name": "CVE-2026-45416",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45416"
    },
    {
      "name": "CVE-2026-50560",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50560"
    },
    {
      "name": "CVE-2025-66614",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66614"
    },
    {
      "name": "CVE-2026-33940",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33940"
    },
    {
      "name": "CVE-2026-44432",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
    },
    {
      "name": "CVE-2026-16243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16243"
    },
    {
      "name": "CVE-2026-9171",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9171"
    },
    {
      "name": "CVE-2026-47010",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47010"
    },
    {
      "name": "CVE-2026-11906",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11906"
    },
    {
      "name": "CVE-2026-22013",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22013"
    },
    {
      "name": "CVE-2026-47057",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47057"
    },
    {
      "name": "CVE-2026-29145",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29145"
    },
    {
      "name": "CVE-2026-14525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14525"
    },
    {
      "name": "CVE-2026-42580",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42580"
    },
    {
      "name": "CVE-2026-18499",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18499"
    },
    {
      "name": "CVE-2026-5516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5516"
    },
    {
      "name": "CVE-2026-33870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33870"
    },
    {
      "name": "CVE-2026-33941",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33941"
    },
    {
      "name": "CVE-2026-7246",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7246"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2026-42585",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42585"
    },
    {
      "name": "CVE-2026-11541",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11541"
    },
    {
      "name": "CVE-2026-11546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11546"
    },
    {
      "name": "CVE-2021-23337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23337"
    },
    {
      "name": "CVE-2026-29146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29146"
    },
    {
      "name": "CVE-2026-10534",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10534"
    },
    {
      "name": "CVE-2026-10109",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10109"
    },
    {
      "name": "CVE-2026-45409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45409"
    },
    {
      "name": "CVE-2026-25645",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25645"
    },
    {
      "name": "CVE-2026-4800",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
    },
    {
      "name": "CVE-2026-42584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42584"
    },
    {
      "name": "CVE-2026-4410",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4410"
    },
    {
      "name": "CVE-2026-45149",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45149"
    },
    {
      "name": "CVE-2026-5598",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5598"
    },
    {
      "name": "CVE-2026-9375",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9375"
    },
    {
      "name": "CVE-2026-34478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34478"
    },
    {
      "name": "CVE-2026-35091",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-35091"
    },
    {
      "name": "CVE-2026-8646",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8646"
    },
    {
      "name": "CVE-2026-34480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34480"
    },
    {
      "name": "CVE-2026-33939",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33939"
    },
    {
      "name": "CVE-2026-9320",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9320"
    },
    {
      "name": "CVE-2026-9762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9762"
    },
    {
      "name": "CVE-2025-68161",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68161"
    },
    {
      "name": "CVE-2026-34479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34479"
    },
    {
      "name": "CVE-2026-47027",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47027"
    },
    {
      "name": "CVE-2026-47058",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47058"
    },
    {
      "name": "CVE-2026-16441",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16441"
    },
    {
      "name": "CVE-2026-9002",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9002"
    },
    {
      "name": "CVE-2025-66471",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66471"
    },
    {
      "name": "CVE-2026-50020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50020"
    },
    {
      "name": "CVE-2026-57819",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57819"
    },
    {
      "name": "CVE-2026-42578",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42578"
    },
    {
      "name": "CVE-2026-2950",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2950"
    },
    {
      "name": "CVE-2026-33916",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33916"
    },
    {
      "name": "CVE-2026-47063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47063"
    },
    {
      "name": "CVE-2026-22021",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22021"
    },
    {
      "name": "CVE-2026-22007",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22007"
    },
    {
      "name": "CVE-2026-10543",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10543"
    },
    {
      "name": "CVE-2026-47021",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47021"
    },
    {
      "name": "CVE-2026-64958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64958"
    },
    {
      "name": "CVE-2026-35092",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-35092"
    },
    {
      "name": "CVE-2026-42583",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42583"
    },
    {
      "name": "CVE-2026-25854",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25854"
    },
    {
      "name": "CVE-2026-46968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46968"
    },
    {
      "name": "CVE-2026-16956",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16956"
    },
    {
      "name": "CVE-2025-36372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36372"
    },
    {
      "name": "CVE-2026-33937",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33937"
    },
    {
      "name": "CVE-2026-10695",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10695"
    },
    {
      "name": "CVE-2026-42581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42581"
    },
    {
      "name": "CVE-2026-16439",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16439"
    },
    {
      "name": "CVE-2026-29129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29129"
    },
    {
      "name": "CVE-2026-11714",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11714"
    },
    {
      "name": "CVE-2026-41417",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41417"
    },
    {
      "name": "CVE-2026-48043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48043"
    },
    {
      "name": "CVE-2026-9322",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9322"
    },
    {
      "name": "CVE-2026-42587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
    },
    {
      "name": "CVE-2026-9563",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9563"
    },
    {
      "name": "CVE-2026-47244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47244"
    },
    {
      "name": "CVE-2026-7771",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7771"
    },
    {
      "name": "CVE-2026-8400",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8400"
    },
    {
      "name": "CVE-2026-12143",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12143"
    },
    {
      "name": "CVE-2026-44431",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
    },
    {
      "name": "CVE-2024-3651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-3651"
    },
    {
      "name": "CVE-2026-33938",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33938"
    },
    {
      "name": "CVE-2026-54225",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54225"
    },
    {
      "name": "CVE-2026-9071",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9071"
    },
    {
      "name": "CVE-2026-11806",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11806"
    },
    {
      "name": "CVE-2026-34477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34477"
    },
    {
      "name": "CVE-2026-60147",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60147"
    },
    {
      "name": "CVE-2025-14813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
    },
    {
      "name": "CVE-2025-13465",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-13465"
    },
    {
      "name": "CVE-2026-10535",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10535"
    },
    {
      "name": "CVE-2026-47059",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47059"
    }
  ],
  "initial_release_date": "2026-08-14T00:00:00",
  "last_revision_date": "2026-08-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1032",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-08-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": "2026-08-11",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7283290",
      "url": "https://www.ibm.com/support/pages/node/7283290"
    },
    {
      "published_at": "2026-08-07",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7282872",
      "url": "https://www.ibm.com/support/pages/node/7282872"
    },
    {
      "published_at": "2026-08-12",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7283489",
      "url": "https://www.ibm.com/support/pages/node/7283489"
    },
    {
      "published_at": "2026-08-10",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7282868",
      "url": "https://www.ibm.com/support/pages/node/7282868"
    },
    {
      "published_at": "2026-08-12",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7283567",
      "url": "https://www.ibm.com/support/pages/node/7283567"
    },
    {
      "published_at": "2026-08-07",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7282947",
      "url": "https://www.ibm.com/support/pages/node/7282947"
    },
    {
      "published_at": "2026-08-07",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7282946",
      "url": "https://www.ibm.com/support/pages/node/7282946"
    },
    {
      "published_at": "2026-08-07",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7282949",
      "url": "https://www.ibm.com/support/pages/node/7282949"
    },
    {
      "published_at": "2026-08-12",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7277422",
      "url": "https://www.ibm.com/support/pages/node/7277422"
    },
    {
      "published_at": "2026-08-12",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7283488",
      "url": "https://www.ibm.com/support/pages/node/7283488"
    },
    {
      "published_at": "2026-08-07",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7279461",
      "url": "https://www.ibm.com/support/pages/node/7279461"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2026-35091 (GCVE-0-2026-35091)

Vulnerability from cvelistv5

CERTFR-2026-AVI-1032

Vulnerability from certfr_avis

Solutions

Tags

Sightings

Nomenclature