The corosync packages for Red Hat Enterprise Linux cluster software contain two security vulnerabilities. CVE-2026-35091 involves denial of service and information disclosure triggered by a crafted UDP packet. CVE-2026-35092 involves denial of service caused by an integer overflow during join message validation. Both vulnerabilities have been assigned a moderate severity rating by Red Hat Product Security. The advisory RHSA-2026:13657 announces the availability of updated corosync packages that fix these issues. The affected products include multiple Red Hat Enterprise Linux 8 variants and architectures. No CVSS base score is provided in the advisory, but the vendor rates the impact as moderate.

Successful exploitation of CVE-2026-35091 can lead to denial of service and information disclosure via crafted UDP packets. CVE-2026-35092 can cause denial of service through an integer overflow in join message validation. Both vulnerabilities affect cluster communication components, potentially impacting cluster stability and confidentiality. There are no known exploits in the wild at this time. The overall security impact is rated moderate by Red Hat Product Security.

Red Hat has released updated corosync packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 8 variants should apply the security update as described in Red Hat advisory RHSA-2026:13657 and the referenced article https://access.redhat.com/articles/11258. Applying the official update fully mitigates the vulnerabilities. No additional mitigation steps are indicated by the vendor.