{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-81665", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-08-27T10:38:28.793Z", "datePublished": "2026-09-04T09:05:35.890Z", "dateUpdated": "2026-09-04T18:25:16.035Z"}, "containers": {"cna": {"title": "Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:enterprise_linux:10"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:enterprise_linux:7"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:enterprise_linux:8"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:enterprise_linux:9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift:4"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhcos", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift:4"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-81665", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524910", "name": "RHBZ#2524910", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-09-04T08:30:05.029Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-122: Heap-based Buffer Overflow", "workarounds": [{"lang": "en", "value": "There is no complete mitigation for this vulnerability short of a fix, but the following steps significantly reduce risk:\n\n1. Ensure cluster message authentication is enabled in corosync.conf: set crypto_cipher to aes256 and crypto_hash to sha256 (or stronger) in the totem {} block, with a shared key generated by corosync-keygen. This is the default when clusters are configured via 'pcs cluster setup', and disabling it (cipher=none/hash=none) is an explicitly unsupported configuration per upstream maintainer guidance.\n2. Restrict network access to the cluster communication ports (default 5405-5412/UDP) to trusted cluster node addresses only, using firewalld or other firewall rules.\n3. Ensure SELinux is running in enforcing mode on cluster nodes to limit the impact of any successful exploitation."}], "timeline": [{"lang": "en", "time": "2026-08-23T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-04T08:30:05.029Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-04T09:05:35.890Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-04T17:09:13.395902Z", "id": "CVE-2026-81665", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-04T18:25:16.035Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-81665", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-08-27T10:38:28.793Z", "datePublished": "2026-09-04T09:05:35.890Z", "dateUpdated": "2026-09-04T18:25:16.035Z"}, "containers": {"cna": {"title": "Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:enterprise_linux:10"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:enterprise_linux:7"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:enterprise_linux:8"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "corosync", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:enterprise_linux:9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift:4"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhcos", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift:4"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-81665", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524910", "name": "RHBZ#2524910", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-09-04T08:30:05.029Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-122: Heap-based Buffer Overflow", "workarounds": [{"lang": "en", "value": "There is no complete mitigation for this vulnerability short of a fix, but the following steps significantly reduce risk:\n\n1. Ensure cluster message authentication is enabled in corosync.conf: set crypto_cipher to aes256 and crypto_hash to sha256 (or stronger) in the totem {} block, with a shared key generated by corosync-keygen. This is the default when clusters are configured via 'pcs cluster setup', and disabling it (cipher=none/hash=none) is an explicitly unsupported configuration per upstream maintainer guidance.\n2. Restrict network access to the cluster communication ports (default 5405-5412/UDP) to trusted cluster node addresses only, using firewalld or other firewall rules.\n3. Ensure SELinux is running in enforcing mode on cluster nodes to limit the impact of any successful exploitation."}], "timeline": [{"lang": "en", "time": "2026-08-23T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-04T08:30:05.029Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-04T09:05:35.890Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-81665", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-04T17:09:13.395902Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-04T17:09:14.391Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "corosync", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "affected", "packageName": "corosync", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "corosync", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "corosync", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "affected", "packageName": "rhcos", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control."}], "id": "CVE-2026-81665", "lastModified": "2026-09-04T19:17:28.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-81665", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-04T17:09:13.395902Z", "version": "2.0.3"}}]}, "published": "2026-09-04T09:17:11.357", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-81665"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524910"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue.", "bugzilla": {"description": "corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly", "id": "2524910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524910"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-122", "details": ["A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control."], "mitigation": {"lang": "en:us", "value": "There is no complete mitigation for this vulnerability short of a fix, but the following steps significantly reduce risk:\n1. Ensure cluster message authentication is enabled in corosync.conf: set crypto_cipher to aes256 and crypto_hash to sha256 (or stronger) in the totem {} block, with a shared key generated by corosync-keygen. This is the default when clusters are configured via 'pcs cluster setup', and disabling it (cipher=none/hash=none) is an explicitly unsupported configuration per upstream maintainer guidance.\n2. Restrict network access to the cluster communication ports (default 5405-5412/UDP) to trusted cluster node addresses only, using firewalld or other firewall rules.\n3. Ensure SELinux is running in enforcing mode on cluster nodes to limit the impact of any successful exploitation."}, "name": "CVE-2026-81665", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "corosync", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "corosync", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "corosync", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "corosync", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-04T08:30:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-81665\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-81665"], "statement": "This vulnerability is rated as Important. The published Red Hat CVSS score is 7.5 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), matching the unmitigated upstream baseline.\nRHEL High Availability Add-On clusters are configured via the pcs (Pacemaker/Corosync configuration system) tool, whose 'pcs cluster setup' command has defaulted to generating a corosync.conf with crypto_hash=sha256 and crypto_cipher=aes256 for multiple RHEL 8.x and 9.x releases, which meaningfully reduces real-world risk by requiring an attacker to already possess the cluster's shared authentication key before the vulnerable code is ever reached. This has been confirmed directly with upstream corosync maintainer Jan Friesse (2026-08-31). However, Jan also confirmed that for RHEL <=10 this protection is a configurable default rather than an enforced, non-optional control: an administrator can disable it via the officially supported 'pcs' interface itself (setting cipher=none, hash=none), not only via unsupported manual editing of corosync.conf. Because encryption can be turned off through a supported configuration path, Red Hat is publishing the CVSS score for the worst-case supported configuration (encryption disabled) rather than crediting the default as a permanent mitigating factor.\nAdministrators who have not explicitly disabled cluster message authentication benefit from a substantially reduced practical risk, equivalent to CVSS 6.4 (CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), since the knet transport rejects unauthenticated packets before they reach the vulnerable reassembly code. See the Mitigation section for guidance on confirming and enforcing this configuration.\nCorosync is shipped in Red Hat Enterprise Linux 7 through 10 and RHIVOS as part of the High Availability Add-On. Firewalld's high-availability service definition (covering the affected knet ports) is not enabled by default, providing additional network-layer defense in depth on systems where firewalld is active. SELinux, enforcing by default on RHEL, confines the corosync_t domain's file writes to corosync-specific paths and restricts network access to UDP only, limiting post-exploitation options, though the domain retains capabilities broad enough that this is not treated as a complete mitigation for CVSS scoring purposes.\nNote: upstream corosync HEAD and current Fedora (which will become RHEL 11) now enforce encryption at compile time, removing the ability to disable it entirely without recompiling from source. Once this reaches RHEL as a supported release, this compensating control will become a true enforced guarantee rather than a configurable default, and the published score is expected to be revisited at that time.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "product": "corosync", "vendor": "corosync"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat Enterprise Linux 10", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Red Hat OpenShift Container Platform 4", "source": "cna", "vendor": "Red Hat"}, "product": "openshift_container_platform", "vendor": "redhat"}], "created": "2026-09-04T10:30:17.943688+00:00", "updated": "2026-09-04T15:20:12.894497+00:00", "vendors": ["corosync", "corosync$PRODUCT$corosync", "redhat", "redhat$PRODUCT$enterprise_linux", "redhat$PRODUCT$openshift_container_platform"]}