The corosync packages for Red Hat Enterprise Linux cluster software contain two security vulnerabilities: CVE-2026-35091, which permits denial of service and information disclosure via crafted UDP packets, and CVE-2026-35092, which permits denial of service via an integer overflow during join message validation. These vulnerabilities affect Red Hat Enterprise Linux 8.4 variants including Advanced Update Support and Extended Update Support editions. Red Hat has issued a security advisory (RHSA-2026:14215) providing updated corosync packages to remediate these issues. The advisory rates the security impact as moderate and references CVE pages for detailed scoring and acknowledgments. No CVSS scores are provided in the advisory. No exploits in the wild are currently known.

Successful exploitation of CVE-2026-35091 can lead to denial of service and information disclosure via crafted UDP packets. CVE-2026-35092 can cause denial of service through an integer overflow in join message validation. Both vulnerabilities affect cluster communication components, potentially impacting cluster stability and confidentiality. The overall security impact is rated moderate by Red Hat. There are no reports of active exploitation in the wild at this time.

Red Hat has released updated corosync packages that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:14215 and the referenced update article (https://access.redhat.com/articles/11258). Applying these official patches will remediate the vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.