CVE-2026-81666
Received Received - Intake

Integer Overflow in Corosync Leading to DoS

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: redhat-SADP

Description
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-81666
EUVD
EUVD-2026-70987

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
corosync corosync From 3.1.10 (inc)
corosync corosync From 7 (inc) to 10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer overflow in Corosync's handling of membership commit token messages. On 32-bit systems, the length-validation check can be bypassed due to an overflow in calculating the expected message length. A crafted network packet can then trigger an out-of-bounds memory access, crashing the Corosync daemon and causing a denial of service for the affected cluster node. The issue does not occur on 64-bit systems.

Detection Guidance

To detect this vulnerability, check if your Corosync cluster is running on a 32-bit system. Inspect the Corosync version and system architecture using commands like 'corosync -v' and 'uname -m'. Monitor for crashes in the Corosync daemon, which may indicate exploitation attempts.

Impact Analysis

The primary impact is a denial of service for the affected cluster node due to the Corosync daemon crashing. This disrupts cluster operations and may affect services relying on the cluster. The risk is higher on 32-bit systems where the overflow can occur. Enabling cluster message authentication reduces the risk significantly.

Compliance Impact

This vulnerability primarily causes a denial of service by crashing the Corosync daemon, which could disrupt cluster operations. It does not directly impact data confidentiality or integrity, so its effect on compliance with standards like GDPR or HIPAA is likely minimal unless service disruption leads to secondary compliance issues.

Mitigation Strategies

Enable cluster message authentication if not already active using 'pcs cluster setup' with crypto_hash and crypto_cipher parameters. Restrict network access to cluster communication ports via firewall rules. Prefer 64-bit deployments where possible. Apply vendor patches when available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81666. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart