A critical vulnerability in Corosync permits unauthenticated remote attackers to trigger a denial of service or memory disclosure through malformed UDP traffic.

The vulnerability stems from an incorrect check of a function return value (CWE-253) within the Corosync membership commit token sanity check. An unauthenticated attacker can trigger this flaw by sending a specially crafted UDP packet, leading to an out-of-bounds read.

The ability for an unauthenticated attacker to remotely disrupt cluster communication poses a significant risk to high-availability environments. A successful denial of service attack can lead to unexpected node failovers or service outages, while the potential for memory disclosure may lead to the leakage of sensitive internal data. With a CVSS score of 8.2, this vulnerability is considered a high-priority threat to infrastructure stability.

Immediate Action: Apply the relevant security updates provided in the Red Hat errata (RHSA-2026:13644 and associated advisories) to patch the affected Corosync packages immediately.

Proactive Monitoring: Monitor network traffic for malformed UDP packets directed at Corosync ports and review cluster logs for unexpected node membership state changes or service crashes.

Compensating Controls: Utilize network-level access control lists or firewalls to restrict access to Corosync UDP ports to trusted cluster members only, which effectively prevents remote unauthenticated exploitation.

Public Exploit Available: No (exploit_available unknown)

Given the potential for service disruption in critical cluster environments, organizations should prioritize the deployment of the vendor-supplied patches. Restricting network access to the Corosync service remains a highly effective secondary control to mitigate risk until patching is fully completed across all production nodes.