# CVE-2026-35091

## Summary

- **CVE ID:** CVE-2026-35091
- **Severity:** HIGH
- **CVSS Score:** 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
- **CWE:** CWE-253
- **Published:** Apr 1, 2026
- **Last Modified:** Aug 21, 2026

## Description

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents. This vulnerability affects Corosync when running in totemudp/totemudpu mode, which is the default configuration.

## Affected Products

- Red Hat — Red Hat Enterprise Linux 10 (0:3.1.9-2.el10_1.1)
- Red Hat — Red Hat Enterprise Linux 8 (0:3.1.8-1.el8_10.1)
- Red Hat — Red Hat Enterprise Linux 9 (0:3.1.9-2.el9_7.1)
- Red Hat — Red Hat Enterprise Linux 10.0 Extended Update Support (0:3.1.9-1.el10_0.2)
- Red Hat — Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support (0:3.1.0-3.el8_4.2)
- Red Hat — Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On (0:3.1.0-3.el8_4.2)
- Red Hat — Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support (0:3.1.5-2.el8_6.1)
- Red Hat — Red Hat Enterprise Linux 8.6 Telecommunications Update Service (0:3.1.5-2.el8_6.1)
- Red Hat — Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions (0:3.1.5-2.el8_6.1)
- Red Hat — Red Hat Enterprise Linux 8.8 Telecommunications Update Service (0:3.1.7-1.el8_8.1)
- Red Hat — Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions (0:3.1.7-1.el8_8.1)
- Red Hat — Red Hat Enterprise Linux 9.4 Extended Update Support (0:3.1.8-1.el9_4.1)
- Red Hat — Red Hat Enterprise Linux 9.6 Extended Update Support (0:3.1.9-2.el9_6.1)
- Red Hat — Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions (0:3.1.5-3.el9_0.1)
- Red Hat — Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions (0:3.1.7-1.el9_2.1)
- Red Hat — Red Hat Enterprise Linux 10 (0:3.1.10-1.el10_2.1)
- Red Hat — Red Hat Enterprise Linux 9 (0:3.1.10-1.el9_8.1)
- Red Hat — Red Hat Enterprise Linux 7 Extended Lifecycle Support (0:2.4.5-7.el7_9.3)

## References

- [CNA](https://access.redhat.com/security/cve/CVE-2026-35091)
- [CNA](https://bugzilla.redhat.com/show_bug.cgi?id=2453169)
- [CNA](https://bugzilla.redhat.com/show_bug.cgi?id=2453813)
- [CNA](https://access.redhat.com/errata/RHSA-2026:13644)
- [CNA](https://access.redhat.com/errata/RHSA-2026:13657)
- [CNA](https://access.redhat.com/errata/RHSA-2026:13673)
- [CNA](https://access.redhat.com/errata/RHSA-2026:14205)
- [CNA](https://access.redhat.com/errata/RHSA-2026:14214)
- [CNA](https://access.redhat.com/errata/RHSA-2026:14215)
- [CNA](https://access.redhat.com/errata/RHSA-2026:14216)
- [CNA](https://access.redhat.com/errata/RHSA-2026:14212)
- [CNA](https://access.redhat.com/errata/RHSA-2026:14213)
- [CNA](https://access.redhat.com/errata/RHSA-2026:14210)
- [CNA](https://access.redhat.com/errata/RHSA-2026:14211)
- [CNA](https://access.redhat.com/errata/RHSA-2026:19043)
- [CNA](https://access.redhat.com/errata/RHSA-2026:19200)
- [CNA](https://access.redhat.com/errata/RHSA-2026:20916)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.87%
- **EPSS Percentile:** 56.6

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._