A remote, unauthenticated denial of service vulnerability in Corosync allows attackers to crash services by sending malicious UDP packets, posing a significant availability risk.

This vulnerability is an integer overflow (CWE-190) within the join message sanity validation logic. It permits an unauthenticated remote attacker to trigger a service crash by sending crafted UDP packets when the cluster is configured to use totemudp or totemudpu transport modes.

The ability for an unauthenticated attacker to remotely crash the Corosync service directly impacts high availability clusters, which are typically critical to business operations. With a CVSS score of 7.5, this high-severity vulnerability represents a significant risk to service continuity, as it can lead to unplanned downtime and the loss of cluster synchronization in production environments.

Immediate Action: Update the Corosync package to the fixed versions provided in the relevant Red Hat Security Advisories (RHSA-2026:13644, RHSA-2026:13657, RHSA-2026:13673, RHSA-2026:14205, RHSA-2026:14210, RHSA-2026:14211, RHSA-2026:14212, and RHSA-2026:14213).

Proactive Monitoring: Monitor system logs for unexpected Corosync service restarts or crash reports that may indicate exploitation attempts.

Compensating Controls: Restrict network access to Corosync cluster communication ports (typically UDP 5404 and 5405) to trusted internal nodes using host-based firewalls or network segmentation to prevent external packet injection.

Public Exploit Available: No

Given the potential for remote service disruption, organizations should prioritize patching Corosync across all affected Red Hat Enterprise Linux environments. Administrators must verify their cluster configuration to confirm the use of totemudp/totemudpu, as these instances are specifically susceptible to the crash condition. Apply the vendor-supplied updates immediately to restore cluster stability and resilience.