Every CVE Search/ Get API key

CVE-2025-30472

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a...

9.0 CriticalFix available

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.47%Up 0.4 points since Mar 22, 2025
90%50%10%1%

What each source reports

CVE List Score used 9.0

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

Record
CVE-2025-30472
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-02
EUVDEUVD-2025-7198 9.0

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

Record
EUVD-2025-7198
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-4q2r-xgxr-vvqm 9.0

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a...

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

Record
GHSA-4q2r-xgxr-vvqm
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-121, CWE-787
Updated
2026-11-02
NVD 9.0

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

Record
CVE-2025-30472
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-121, CWE-787
Updated
2026-11-02
OSVAZL-59189 9.8

CVE-2025-30472 affecting package corosync 3.0.4-3

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

Record
AZL-59189
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-61774 9.8

CVE-2025-30472 affecting package corosync 3.0.4-4

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

Record
AZL-61774
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
Show 17 moreShow less
OSV 9.0

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

Record
CVE-2025-30472
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-02
OSVDEBIAN-CVE-2025-30472 9.8

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

Record
DEBIAN-CVE-2025-30472
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-1365 9.0

corosync security update

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script.

Security Fix(es):

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.(CVE-2025-30472)

Record
OESA-2025-1365
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:7201 6.6

Red Hat Security Advisory: corosync security update

Record
RHSA-2025:7201
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:7478 6.6

Red Hat Security Advisory: corosync security update

Record
RHSA-2025:7478
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:7201 6.6

Moderate: corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for Rocky Linux cluster software.

Security Fix(es):

  • corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Record
RLSA-2025:7201
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:7478 6.6

Moderate: corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for Rocky Linux cluster software.

Security Fix(es):

  • corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:7478
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-30472 9.0

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

Record
UBUNTU-CVE-2025-30472
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2025:7201 No score

Moderate: corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software.

Security Fix(es):

  • corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

Record
ALSA-2025:7201
Updated
2026-11-02
OSVALSA-2025:7478 No score

Moderate: corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software.

Security Fix(es):

  • corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:7478
Updated
2026-11-02
OSVCLSA-2025-1747251688 No score

corosync: Fix of CVE-2025-30472

  • CVE-2025-30472: fix stack-based buffer overflow in orf_token_endian_convert by adding input validation for large UDP packets
Record
CLSA-2025-1747251688
Updated
2026-11-02
OSVCLSA-2026-1792591710 No score

corosync: Fix of 4 CVEs

  • CVE-2025-30472: stack buffer overflow in orf_token_endian_convert()
  • CVE-2026-35091: out-of-bounds read via check_memb_commit_token_sanity()
  • CVE-2026-35092: integer overflow in check_memb_join_sanity()
  • CVE-2026-81665: heap buffer overflow in totempg_deliver_fn()
Record
CLSA-2026-1792591710
Updated
2026-11-02
OSVCLSA-2026-1792622946 No score

corosync: Fix of 4 CVEs

  • CVE-2025-30472: stack buffer overflow in orf_token_endian_convert()
  • CVE-2026-35091: out-of-bounds read via check_memb_commit_token_sanity()
  • CVE-2026-35092: integer overflow in check_memb_join_sanity()
  • CVE-2026-81665: heap buffer overflow in totempg_deliver_fn()
Record
CLSA-2026-1792622946
Updated
2026-11-02
OSVMGASA-2025-0127 No score

Updated corosync packages fix security vulnerability

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet. (CVE-2025-30472)

Record
MGASA-2025-0127
Updated
2026-11-02
OSVopenSUSE-SU-2025:14933-1 No score

corosync-3.1.9-2.1 on GA media

These are all security issues fixed in the corosync-3.1.9-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14933-1
Updated
2026-11-02
OSVSUSE-SU-2025:1084-1 No score

Security update for corosync

This update for corosync fixes the following issues:

  • CVE-2025-30472: Fixed stack buffer overflow from 'orf_token_endian_convert' (bsc#1239987)
Record
SUSE-SU-2025:1084-1
Updated
2026-11-02
OSVUSN-7478-1 No score

corosync vulnerability

It was discovered that Corosync incorrectly handled certain large UDP packets. If encryption is disabled, or an attacker knows the encryption key, this issue could be used to cause Corosync to crash, resulting in a denial of service.

Record
USN-7478-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
corosync-vqsim
AlmaLinux:9
 before 3.1.9-2.el9_6
3.1.9-2.el9_6
corosynclib
AlmaLinux:9
 before 3.1.9-2.el9_6
3.1.9-2.el9_6
corosync-vqsim
AlmaLinux:10
 before 3.1.9-1.el10_0.1
3.1.9-1.el10_0.1
corosynclib
AlmaLinux:10
 before 3.1.9-1.el10_0.1
3.1.9-1.el10_0.1
corosync
Azure Linux:2
 through 3.0.4-3 None known
corosync
Azure Linux:3
 through 3.0.4-4 None known
corosync
TuxCare:AlmaLinux:9.2
 before 3.1.7-1.el9.tuxcare.els1
3.1.7-1.el9.tuxcare.els1
corosync-vqsim
TuxCare:AlmaLinux:9.2
 before 3.1.7-1.el9.tuxcare.els1
3.1.7-1.el9.tuxcare.els1
corosynclib
TuxCare:AlmaLinux:9.2
 before 3.1.7-1.el9.tuxcare.els1
3.1.7-1.el9.tuxcare.els1
corosynclib-devel
TuxCare:AlmaLinux:9.2
 before 3.1.7-1.el9.tuxcare.els1
3.1.7-1.el9.tuxcare.els1
Show 65 moreShow less
Affected packages
PackageAffectedFixed
corosync
TuxCare:CentOS:8.4
From an advisory covering 4 CVEs
 before 3.1.0-3.el8_4.1.tuxcare.els1
3.1.0-3.el8_4.1.tuxcare.els1
corosync-vqsim
TuxCare:CentOS:8.4
From an advisory covering 4 CVEs
 before 3.1.0-3.el8_4.1.tuxcare.els1
3.1.0-3.el8_4.1.tuxcare.els1
corosynclib
TuxCare:CentOS:8.4
From an advisory covering 4 CVEs
 before 3.1.0-3.el8_4.1.tuxcare.els1
3.1.0-3.el8_4.1.tuxcare.els1
corosynclib-devel
TuxCare:CentOS:8.4
From an advisory covering 4 CVEs
 before 3.1.0-3.el8_4.1.tuxcare.els1
3.1.0-3.el8_4.1.tuxcare.els1
spausedd
TuxCare:CentOS:8.4
From an advisory covering 4 CVEs
 before 3.1.0-3.el8_4.1.tuxcare.els1
3.1.0-3.el8_4.1.tuxcare.els1
corosync
TuxCare:CentOS:8.5
From an advisory covering 4 CVEs
 before 3.1.5-1.el8.tuxcare.els1
3.1.5-1.el8.tuxcare.els1
corosync-vqsim
TuxCare:CentOS:8.5
From an advisory covering 4 CVEs
 before 3.1.5-1.el8.tuxcare.els1
3.1.5-1.el8.tuxcare.els1
corosynclib
TuxCare:CentOS:8.5
From an advisory covering 4 CVEs
 before 3.1.5-1.el8.tuxcare.els1
3.1.5-1.el8.tuxcare.els1
corosynclib-devel
TuxCare:CentOS:8.5
From an advisory covering 4 CVEs
 before 3.1.5-1.el8.tuxcare.els1
3.1.5-1.el8.tuxcare.els1
spausedd
TuxCare:CentOS:8.5
From an advisory covering 4 CVEs
 before 3.1.5-1.el8.tuxcare.els1
3.1.5-1.el8.tuxcare.els1
corosync
Debian:12
 before 3.1.7-1+deb12u1, plus listed versions
3.1.7-1
3.1.7-1+deb12u1
corosync
Debian:13
 before 3.1.9-2
3.1.9-2
corosync
Debian:14
 before 3.1.9-2
3.1.9-2
corosync
Debian:11
 before 3.1.2-2+deb11u1, plus listed versions
3.1.2-2
3.1.2-2+deb11u1
corosync
Mageia:9
 before 3.1.7-1.1.mga9
3.1.7-1.1.mga9
corosync
openEuler:22.03-LTS-SP4
 before 3.1.5-2.oe2203sp4
3.1.5-2.oe2203sp4
corosync
openEuler:24.03-LTS
 before 3.1.8-7.oe2403sp1
3.1.8-7.oe2403sp1
corosync
openEuler:24.03-LTS-SP1
 before 3.1.8-7.oe2403sp1
3.1.8-7.oe2403sp1
corosync
openEuler:20.03-LTS-SP4
 before 3.0.2-6.oe2003sp4
3.0.2-6.oe2003sp4
corosync
openEuler:22.03-LTS-SP3
 before 3.1.5-2.oe2203sp3
3.1.5-2.oe2203sp3
corosync
Red Hat:enterprise_linux:9::appstream
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync-vqsim-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosynclib
Red Hat:enterprise_linux:9::appstream
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosynclib-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync-debugsource
Red Hat:enterprise_linux:9::crb
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync-vqsim
Red Hat:enterprise_linux:9::crb
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync-vqsim-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosynclib-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync
Red Hat:enterprise_linux:9::highavailability
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync-debuginfo
Red Hat:enterprise_linux:9::highavailability
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync-debugsource
Red Hat:enterprise_linux:9::highavailability
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync-vqsim-debuginfo
Red Hat:enterprise_linux:9::highavailability
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosynclib-debuginfo
Red Hat:enterprise_linux:9::highavailability
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosynclib-devel
Red Hat:enterprise_linux:9::highavailability
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync
Red Hat:enterprise_linux:9::resilientstorage
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync-debuginfo
Red Hat:enterprise_linux:9::resilientstorage
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync-debugsource
Red Hat:enterprise_linux:9::resilientstorage
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync-vqsim-debuginfo
Red Hat:enterprise_linux:9::resilientstorage
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosynclib-debuginfo
Red Hat:enterprise_linux:9::resilientstorage
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosynclib-devel
Red Hat:enterprise_linux:9::resilientstorage
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync
Red Hat:enterprise_linux:10.0
 before 0:3.1.9-1.el10_0.1
0:3.1.9-1.el10_0.1
corosync-debuginfo
Red Hat:enterprise_linux:10.0
 before 0:3.1.9-1.el10_0.1
0:3.1.9-1.el10_0.1
corosync-debugsource
Red Hat:enterprise_linux:10.0
 before 0:3.1.9-1.el10_0.1
0:3.1.9-1.el10_0.1
corosync-vqsim-debuginfo
Red Hat:enterprise_linux:10.0
 before 0:3.1.9-1.el10_0.1
0:3.1.9-1.el10_0.1
corosynclib
Red Hat:enterprise_linux:10.0
 before 0:3.1.9-1.el10_0.1
0:3.1.9-1.el10_0.1
corosynclib-debuginfo
Red Hat:enterprise_linux:10.0
 before 0:3.1.9-1.el10_0.1
0:3.1.9-1.el10_0.1
corosync-vqsim
Red Hat:enterprise_linux:10.0
 before 0:3.1.9-1.el10_0.1
0:3.1.9-1.el10_0.1
corosynclib-devel
Red Hat:enterprise_linux:10.0
 before 0:3.1.9-1.el10_0.1
0:3.1.9-1.el10_0.1
corosync
Rocky Linux:9
 before 0:3.1.9-2.el9_6
0:3.1.9-2.el9_6
corosync
Rocky Linux:10
 before 0:3.1.9-1.el10_0.1
0:3.1.9-1.el10_0.1
corosync
SUSE:Linux Enterprise High Availability Extension 15 SP3
 before 2.4.6-150300.12.13.1
2.4.6-150300.12.13.1
corosync
SUSE:Linux Enterprise High Availability Extension 15 SP4
 before 2.4.6-150300.12.13.1
2.4.6-150300.12.13.1
corosync
SUSE:Linux Enterprise High Availability Extension 15 SP5
 before 2.4.6-150300.12.13.1
2.4.6-150300.12.13.1
corosync
SUSE:Linux Enterprise High Availability Extension 15 SP6
 before 2.4.6-150300.12.13.1
2.4.6-150300.12.13.1
corosync
openSUSE:Leap 15.6
 before 2.4.6-150300.12.13.1
2.4.6-150300.12.13.1
corosync
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.3.4-0ubuntu12.3.5-32.3.5-3ubuntu12.3.5-3ubuntu22.3.5-3ubuntu2.12.3.5-3ubuntu2.3
 None known
corosync
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.4.2-3build12.4.2-3ubuntu12.4.3-0ubuntu12.4.3-0ubuntu1.12.4.3-0ubuntu1.22.4.3-0ubuntu1.3
 None known
corosync
Ubuntu:20.04:LTS
 before 3.0.3-2ubuntu2.2, plus listed versions
3.0.1-2ubuntu13.0.2-1ubuntu13.0.2-1ubuntu23.0.3-2ubuntu13.0.3-2ubuntu23.0.3-2ubuntu2.1
3.0.3-2ubuntu2.2
corosync
Ubuntu:22.04:LTS
 before 3.1.6-1ubuntu1.1, plus listed versions
3.1.2-2ubuntu13.1.6-1ubuntu1
3.1.6-1ubuntu1.1
corosync
Ubuntu:24.04:LTS
 before 3.1.7-1ubuntu3.1, plus listed versions
3.1.7-1ubuntu13.1.7-1ubuntu23.1.7-1ubuntu3
3.1.7-1ubuntu3.1
corosync
Ubuntu:25.10
 before 3.1.8-3ubuntu2
3.1.8-3ubuntu2
corosync
openSUSE:Tumbleweed
 before 3.1.9-2.1
3.1.9-2.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-30472 is a critical vulnerability (CVSS 9.0) in Corosync, published March 22, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in corosync-vqsim 3.1.9-2.el9_6.

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open