Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux corosync can crash when handling crafted messages
published 1 month ago
Summary
The Corosync cluster component used in AlmaLinux can be made to overflow memory when it reassembles certain fragmented messages, which may cause the service to stop working. This affects the corosync package and its related libraries. Update to the latest version of corosync and its libraries to apply the fix.
What to do
- Update almalinux corosync to version 3.1.10-1.el10_2.2.
- Update almalinux corosync-vqsim to version 3.1.10-1.el10_2.2.
- Update almalinux corosynclib to version 3.1.10-1.el10_2.2.
- Update almalinux corosynclib-devel to version 3.1.10-1.el10_2.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | corosync |
< 3.1.10-1.el10_2.2 Fix: upgrade to 3.1.10-1.el10_2.2
|
| AlmaLinux:10 | almalinux | corosync-vqsim |
< 3.1.10-1.el10_2.2 Fix: upgrade to 3.1.10-1.el10_2.2
|
| AlmaLinux:10 | almalinux | corosynclib |
< 3.1.10-1.el10_2.2 Fix: upgrade to 3.1.10-1.el10_2.2
|
| AlmaLinux:10 | almalinux | corosynclib-devel |
< 3.1.10-1.el10_2.2 Fix: upgrade to 3.1.10-1.el10_2.2
|
Original advisory text
Important: corosync security update
The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software.
Security Fix(es):
* corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (CVE-2026-81665)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (CVE-2026-81665)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:67872 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-81665 Third Party Advisory
- https://bugzilla.redhat.com/2524910 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2026-67872.html Vendor Advisory
Timeline
Published16 Sep 2026
Updated30 Sep 2026
First seen30 Sep 2026
Sources
ALSA-2026:67872 · OSV
Track software like this
Free during beta