The corosync packages in Red Hat Enterprise Linux cluster software contain two vulnerabilities: CVE-2026-35091 enables denial of service and information disclosure through crafted UDP packets, and CVE-2026-35092 enables denial of service via an integer overflow during join message validation. Red Hat has issued a security advisory (RHSA-2026:14214) describing these issues and providing updated packages for Red Hat Enterprise Linux 8.6 variants. The vulnerabilities are rated as moderate in severity. No CVSS base score is provided in the advisory, but the impact includes denial of service and potential information disclosure. The advisory includes instructions to apply the update to affected systems.

Successful exploitation of CVE-2026-35091 can cause denial of service and information disclosure via crafted UDP packets. CVE-2026-35092 can cause denial of service due to an integer overflow in join message validation. Both vulnerabilities affect cluster communication components, potentially disrupting cluster operations and exposing information. There are no known exploits in the wild at this time. The impact is rated moderate by Red Hat Product Security.

Red Hat has released updated corosync packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 8.6 and related variants should apply the security update as described in Red Hat advisory RHSA-2026:14214 and the referenced update article (https://access.redhat.com/articles/11258). Applying this update remediates the denial of service and information disclosure issues. No additional mitigation steps are indicated by the vendor.