CVE-2026-81666
Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
- Record
CVE-2026-81666- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-06
EUVDEUVD-2026-70987
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
- Record
EUVD-2026-70987- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-8297-6g53-8gp5
An integer overflow was found in Corosync's handling of membership commit token messages. The...
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
- Record
GHSA-8297-6g53-8gp5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
- Record
CVE-2026-81666- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-81666
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
- Record
DEBIAN-CVE-2026-81666- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-04
OSVUBUNTU-CVE-2026-81666
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
- Record
UBUNTU-CVE-2026-81666- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2026:11715-1 No score
corosync-3.1.10-5.1 on GA media
These are all security issues fixed in the corosync-3.1.10-5.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11715-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21887-1 No score
Security update for corosync
This update for corosync fixes the following issues:
- CVE-2026-81665: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (bsc#1278738).
- CVE-2026-81666: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems (bsc#1278739).
- Record
openSUSE-SU-2026:21887-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23850-1 No score
Security update for corosync
This update for corosync fixes the following issues:
- CVE-2026-81665: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (bsc#1278738).
- CVE-2026-81666: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems (bsc#1278739).
- Record
SUSE-SU-2026:23850-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4202-1 No score
Security update for corosync
This update for corosync fixes the following issues:
- CVE-2026-81665: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (bsc#1278738).
- CVE-2026-81666: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems (bsc#1278739).
- Record
SUSE-SU-2026:4202-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
corosyncDebian:12 |
All versions, plus listed versions 3.1.10-13.1.10-23.1.10-33.1.10-43.1.10-5 Show 8 moreShow less3.1.7-13.1.7-1+deb12u13.1.7-1+deb12u23.1.8-13.1.8-23.1.8-33.1.9-13.1.9-2 |
None known |
corosyncDebian:13 |
All versions, plus listed versions 3.1.10-13.1.10-23.1.10-33.1.10-43.1.10-53.1.9-23.1.9-2+deb13u1 |
None known |
corosyncDebian:14 |
All versions, plus listed versions 3.1.10-13.1.10-23.1.10-33.1.10-43.1.10-53.1.9-2 |
None known |
corosyncSUSE:Linux Enterprise High Availability Extension 16.0 From an advisory covering 2 CVEs |
before 3.1.9-160000.4.1 | 3.1.9-160000.4.1 |
corosyncSUSE:Linux Enterprise High Availability Extension 15 SP4 From an advisory covering 2 CVEs |
before 2.4.6-150300.12.19.1 | 2.4.6-150300.12.19.1 |
corosyncSUSE:Linux Enterprise High Availability Extension 15 SP5 From an advisory covering 2 CVEs |
before 2.4.6-150300.12.19.1 | 2.4.6-150300.12.19.1 |
corosyncSUSE:Linux Enterprise High Availability Extension 15 SP6 From an advisory covering 2 CVEs |
before 2.4.6-150300.12.19.1 | 2.4.6-150300.12.19.1 |
corosyncSUSE:Linux Enterprise High Availability Extension 15 SP7 From an advisory covering 2 CVEs |
before 2.4.6-150300.12.19.1 | 2.4.6-150300.12.19.1 |
corosyncUbuntu:16.04:LTS |
All versions, plus listed versions 2.3.4-0ubuntu12.3.5-32.3.5-3ubuntu12.3.5-3ubuntu22.3.5-3ubuntu2.12.3.5-3ubuntu2.3 |
None known |
corosyncUbuntu:18.04:LTS |
All versions, plus listed versions 2.4.2-3build12.4.2-3ubuntu12.4.3-0ubuntu12.4.3-0ubuntu1.12.4.3-0ubuntu1.22.4.3-0ubuntu1.3 |
None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
corosyncUbuntu:20.04:LTS |
All versions, plus listed versions 3.0.1-2ubuntu13.0.2-1ubuntu13.0.2-1ubuntu23.0.3-2ubuntu13.0.3-2ubuntu23.0.3-2ubuntu2.13.0.3-2ubuntu2.2 |
None known |
corosyncUbuntu:22.04:LTS |
All versions, plus listed versions 3.1.2-2ubuntu13.1.6-1ubuntu13.1.6-1ubuntu1.13.1.6-1ubuntu1.2 |
None known |
corosyncUbuntu:24.04:LTS |
All versions, plus listed versions 3.1.7-1ubuntu13.1.7-1ubuntu23.1.7-1ubuntu33.1.7-1ubuntu3.13.1.7-1ubuntu3.2 |
None known |
corosyncUbuntu:26.10 |
All versions, plus listed versions 3.1.9-2ubuntu33.1.10-2ubuntu23.1.10-3ubuntu1 |
None known |
corosyncUbuntu:26.04:LTS |
All versions, plus listed versions 3.1.9-2ubuntu13.1.9-2ubuntu23.1.9-2ubuntu3 |
None known |
corosyncopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 3.1.10-5.1 | 3.1.10-5.1 |
corosyncopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 3.1.9-160000.4.1 | 3.1.9-160000.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | CVE List, EUVD, NVD, OSV | |
| facts, products | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-81666 is a medium vulnerability (CVSS 6.5) in Red Hat Enterprise Linux 10, published September 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 15th percentile. No source names a fixed version.