A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents. This vulnerability affects Corosync when running in totemudp/totemudpu mode, which is the default configuration.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1394-1 advisory.

    - CVE-2026-35091: Denial of Service and information disclosure via crafted UDP packet (bsc#1261299).
    - CVE-2026-35092: Denial of Service via integer overflow in join message validation (bsc#1261300).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8170-1 advisory.

    It was discovered that Corosync incorrectly handled the membership commit token validity check. A remote     attacker could use this issue to cause Corosync to crash, resulting in a denial of service, or to possibly     obtain a small quantity of sensitive information. (CVE-2026-35091)

    It was discovered that Corosync incorrectly handled join message validation. A remote attacker could     possibly use this issue to cause Corosync to crash, resulting in a denial of service. (CVE-2026-35092)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1560 advisory.

    A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value     vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User     Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS)     and potentially disclosing limited memory contents. This vulnerability affects Corosync when running in     totemudp/totemudpu mode, which is the default configuration. (CVE-2026-35091)

    A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity     validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets.
    This can cause the service to crash, leading to a denial of service. This vulnerability specifically     affects Corosync deployments configured to use totemudp/totemudpu mode. (CVE-2026-35092)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-95ee0edcd5 advisory.

    Security fix for CVE-2026-35091 and CVE-2026-35092

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ee4ff58256 advisory.

    Security fix for CVE-2026-35091 and CVE-2026-35092

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value     vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User     Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS)     and potentially disclosing limited memory contents. This vulnerability affects Corosync when running in     totemudp/totemudpu mode, which is the default configuration. (CVE-2026-35091)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
306885	SUSE SLES15 / openSUSE 15 Security Update : corosync (SUSE-SU-2026:1394-1)	Nessus	SuSE Local Security Checks	high
306304	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : Corosync vulnerabilities (USN-8170-1)	Nessus	Ubuntu Local Security Checks	high
306238	Amazon Linux 2023 : corosync, corosync-vqsim, corosynclib (ALAS2023-2026-1560)	Nessus	Amazon Linux Local Security Checks	high
306047	Fedora 42 : corosync (2026-95ee0edcd5)	Nessus	Fedora Local Security Checks	high
305244	Fedora 43 : corosync (2026-ee4ff58256)	Nessus	Fedora Local Security Checks	high
304623	Linux Distros Unpatched Vulnerability : CVE-2026-35091	Nessus	Misc.	high

Detections

Analytics

CVE-2026-35091

high

Tenable Plugins

high

high

high

high

high

high