USN-8170-1: Corosync vulnerabilities

USN-8170-1: Corosync vulnerabilities

Publication date: 13 April 2026
Overview: Several security issues were fixed in Corosync.

Packages
corosync - cluster engine daemon and utilities

Details
It was discovered that Corosync incorrectly handled the membership commit
token validity check. A remote attacker could use this issue to cause
Corosync to crash, resulting in a denial of service, or to possibly obtain
a small quantity of sensitive information. (CVE-2026-35091)

It was discovered that Corosync incorrectly handled join message
validation. A remote attacker could possibly use this issue to cause
Corosync to crash, resulting in a denial of service. (CVE-2026-35092)

Update instructions
After a standard system update you need to restart Corosync to make all the necessary changes.

The problem can be corrected by updating your system to the following package versions:

• 25.10 questing corosync – 3.1.9-2ubuntu1.1
• 24.04 LTS noble corosync – 3.1.7-1ubuntu3.2
• 22.04 LTS jammy corosync – 3.1.6-1ubuntu1.2