{"id":"CVE-2025-30472","aliases":["ALSA-2025:7201","ALSA-2025:7478","AZL-59189","AZL-61774","CLSA-2025-1747251688","CLSA-2026-1792591710","CLSA-2026-1792622946","DEBIAN-CVE-2025-30472","DLA-4308-1","EUVD-2025-7198","GHSA-4q2r-xgxr-vvqm","MGASA-2025-0127","OESA-2025-1365","RHSA-2025:7201","RHSA-2025:7478","RLSA-2025:7201","RLSA-2025:7478","SUSE-SU-2025:1084-1","UBUNTU-CVE-2025-30472","USN-7478-1","openSUSE-SU-2025:14933-1"],"status":"published","title":"Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a...","description":"Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.","severity":{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00469,"percentile":0.40898,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-787"],"published":"2025-03-22T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"corosync-vqsim","fixed_in":["3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"corosynclib","fixed_in":["3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"corosync-vqsim","fixed_in":["3.1.9-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"corosynclib","fixed_in":["3.1.9-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"corosync","fixed_in":["3.1.7-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"corosync-vqsim","fixed_in":["3.1.7-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"corosynclib","fixed_in":["3.1.7-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"corosynclib-devel","fixed_in":["3.1.7-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"corosync","fixed_in":["3.1.7-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"corosync","fixed_in":["3.1.9-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"corosync","fixed_in":["3.1.9-2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"corosync","fixed_in":["3.1.2-2+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"corosync","fixed_in":["3.1.7-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"corosync","fixed_in":["3.1.5-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"corosync","fixed_in":["3.1.8-7.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"corosync","fixed_in":["3.1.8-7.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"corosync","fixed_in":["3.0.2-6.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"corosync","fixed_in":["3.1.5-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"corosync","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"corosync-debuginfo","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"corosync-debugsource","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"corosync-vqsim-debuginfo","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"corosynclib","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"corosynclib-debuginfo","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"corosync-debuginfo","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"corosync-debugsource","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"corosync-vqsim","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"corosync-vqsim-debuginfo","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"corosynclib-debuginfo","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"corosync","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"corosync-debuginfo","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"corosync-debugsource","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"corosync-vqsim-debuginfo","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"corosynclib-debuginfo","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"corosynclib-devel","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"corosync","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"corosync-debuginfo","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"corosync-debugsource","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"corosync-vqsim-debuginfo","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"corosynclib-debuginfo","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"corosynclib-devel","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosync","fixed_in":["0:3.1.9-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosync-debuginfo","fixed_in":["0:3.1.9-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosync-debugsource","fixed_in":["0:3.1.9-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosync-vqsim-debuginfo","fixed_in":["0:3.1.9-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosynclib","fixed_in":["0:3.1.9-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosynclib-debuginfo","fixed_in":["0:3.1.9-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosync-vqsim","fixed_in":["0:3.1.9-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosynclib-devel","fixed_in":["0:3.1.9-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"corosync","fixed_in":["0:3.1.9-2.el9_6"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"corosync","fixed_in":["0:3.1.9-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"corosync","fixed_in":["2.4.6-150300.12.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"corosync","fixed_in":["2.4.6-150300.12.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"corosync","fixed_in":["2.4.6-150300.12.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"corosync","fixed_in":["2.4.6-150300.12.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"corosync","fixed_in":["2.4.6-150300.12.13.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"corosync","fixed_in":["3.0.3-2ubuntu2.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"corosync","fixed_in":["3.1.6-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"corosync","fixed_in":["3.1.7-1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"corosync","fixed_in":["3.1.8-3ubuntu2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"corosync","fixed_in":["3.1.9-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"corosync-vqsim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"corosynclib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"corosync-vqsim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.9-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"corosynclib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.9-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.4-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.4-4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"corosync-vqsim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"corosynclib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"corosynclib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-3.el8_4.1.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"corosync-vqsim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-3.el8_4.1.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"corosynclib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-3.el8_4.1.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"corosynclib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-3.el8_4.1.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"spausedd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-3.el8_4.1.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-1.el8.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"corosync-vqsim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-1.el8.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"corosynclib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-1.el8.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"corosynclib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-1.el8.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"spausedd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-1.el8.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-1+deb12u1"}]}],"versions":["3.1.7-1"]},{"source":"osv","ecosystem":"Debian:13","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.9-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.9-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2+deb11u1"}]}],"versions":["3.1.2-2"]},{"source":"osv","ecosystem":"Mageia:9","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.8-7.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.8-7.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-6.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"corosync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"corosync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"corosync-vqsim-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"corosynclib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"corosynclib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"corosync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"corosync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"corosync-vqsim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"corosync-vqsim-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"corosynclib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"corosync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"corosync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"corosync-vqsim-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"corosynclib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"corosynclib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"corosync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"corosync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"corosync-vqsim-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"corosynclib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"corosynclib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosync-vqsim-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosynclib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosynclib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosync-vqsim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"corosynclib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-2.el9_6"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.9-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-150300.12.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-150300.12.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-150300.12.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-150300.12.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-150300.12.13.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.4-0ubuntu1","2.3.5-3","2.3.5-3ubuntu1","2.3.5-3ubuntu2","2.3.5-3ubuntu2.1","2.3.5-3ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.2-3build1","2.4.2-3ubuntu1","2.4.3-0ubuntu1","2.4.3-0ubuntu1.1","2.4.3-0ubuntu1.2","2.4.3-0ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-2ubuntu2.2"}]}],"versions":["3.0.1-2ubuntu1","3.0.2-1ubuntu1","3.0.2-1ubuntu2","3.0.3-2ubuntu1","3.0.3-2ubuntu2","3.0.3-2ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-1ubuntu1.1"}]}],"versions":["3.1.2-2ubuntu1","3.1.6-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-1ubuntu3.1"}]}],"versions":["3.1.7-1ubuntu1","3.1.7-1ubuntu2","3.1.7-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.8-3ubuntu2"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-2ubuntu2.2"}]}],"versions":["3.0.1-2ubuntu1","3.0.2-1ubuntu1","3.0.2-1ubuntu2","3.0.3-2ubuntu1","3.0.3-2ubuntu2","3.0.3-2ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-1ubuntu1.1"}]}],"versions":["3.1.2-2ubuntu1","3.1.6-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-1ubuntu3.1"}]}],"versions":["3.1.7-1ubuntu1","3.1.7-1ubuntu2","3.1.7-1ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.9-2.1"}]}]}],"products":[{"vendor":"corosync","product":"corosync"}],"references":[{"url":"https://github.com/corosync/corosync/blob/73ba225cc48ebb1903897c792065cb5e876613b0/exec/totemsrp.c#L4677","tags":["Product","web","article","report"]},{"url":"https://github.com/corosync/corosync/issues/778","tags":["exploit","Exploit","Issue Tracking","report","article"]},{"url":"https://corosync.org","tags":["Product","web","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00023.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30472","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4q2r-xgxr-vvqm"},{"url":"https://access.redhat.com/errata/RHSA-2025:7201","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30472","tags":["report"]},{"url":"https://bugzilla.redhat.com/2354229","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-7201.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7478","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-7478.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1747251688.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1792591710.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35091","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35092","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81665","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1792622946.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30472.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-30472","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0127.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34146","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/L63W4FOTC7DCCZ5Z6IDGHNMPP3LXH2YY/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1365","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2354229","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-65699","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7201.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-30472","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7478.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7201","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7478","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251084-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239987","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30472","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-30472","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7478-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/L63W4FOTC7DCCZ5Z6IDGHNMPP3LXH2YY/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-30472","description":"Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.","status":"published","published":"2025-03-22T00:00:00Z","modified":"2025-11-03T18:09:02.939Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:32:35.099955Z"}],"euvd":[{"id":"EUVD-2025-7198","description":"Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.","status":"published","published":"2025-03-22T00:00:00Z","modified":"2025-11-03T18:09:02Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:34.635725Z"}],"ghsa":[{"id":"GHSA-4q2r-xgxr-vvqm","title":"Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a...","description":"Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.","status":"published","published":"2025-03-22T03:30:32Z","modified":"2025-11-03T21:33:13Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T15:04:22.088739Z"}],"nvd":[{"id":"CVE-2025-30472","description":"Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.","status":"published","published":"2025-03-22T02:15:16.62Z","modified":"2026-06-17T09:08:48.87Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:10:54.744127Z"}],"osv":[{"id":"AZL-59189","title":"CVE-2025-30472 affecting package corosync 3.0.4-3","description":"Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.","status":"published","published":"2025-03-22T02:15:16Z","modified":"2026-04-21T04:37:12.947213Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"AZL-61774","title":"CVE-2025-30472 affecting package corosync 3.0.4-4","description":"Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.","status":"published","published":"2025-03-22T02:15:16Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"CVE-2025-30472","description":"Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.","status":"published","published":"2025-03-22T00:00:00Z","modified":"2026-10-28T02:31:06.681879556Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"DEBIAN-CVE-2025-30472","description":"Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.","status":"published","published":"2025-03-22T02:15:16.62Z","modified":"2026-09-01T20:05:45.722399566Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"OESA-2025-1365","title":"corosync security update","description":"This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script.\r\n\r\nSecurity Fix(es):\n\nCorosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.(CVE-2025-30472)","status":"published","published":"2025-04-03T11:08:27Z","modified":"2026-08-18T01:17:51.235773935Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"RHSA-2025:7201","title":"Red Hat Security Advisory: corosync security update","status":"published","published":"2025-05-14T10:06:00Z","modified":"2026-08-07T10:20:17Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7478","title":"Red Hat Security Advisory: corosync security update","status":"published","published":"2025-05-14T10:06:33Z","modified":"2026-08-07T10:20:30Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:7201","title":"Moderate: corosync security update","description":"The corosync packages provide the Corosync Cluster Engine and C APIs for Rocky Linux cluster software.\n\nSecurity Fix(es):\n\n* corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:39:27.451266Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:7478","title":"Moderate: corosync security update","description":"The corosync packages provide the Corosync Cluster Engine and C APIs for Rocky Linux cluster software.\n\nSecurity Fix(es):\n\n* corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-03T20:19:01.824107Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2025-30472","description":"Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.","status":"published","published":"2025-03-22T02:15:00Z","modified":"2026-04-22T15:41:10.587897Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"ALSA-2025:7201","title":"Moderate: corosync security update","description":"The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software.  \n\nSecurity Fix(es):  \n\n  * corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:31:27.324901421Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:7478","title":"Moderate: corosync security update","description":"The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software.  \n\nSecurity Fix(es):  \n\n  * corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:58:15.074773Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"CLSA-2025-1747251688","title":"corosync: Fix of CVE-2025-30472","description":"- CVE-2025-30472: fix stack-based buffer overflow in orf_token_endian_convert by\n  adding input validation for large UDP packets","status":"published","published":"2025-05-14T19:41:33Z","modified":"2026-06-01T00:30:44.666301769Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2026-1792591710","title":"corosync: Fix of 4 CVEs","description":"- CVE-2025-30472: stack buffer overflow in orf_token_endian_convert()\n- CVE-2026-35091: out-of-bounds read via check_memb_commit_token_sanity()\n- CVE-2026-35092: integer overflow in check_memb_join_sanity()\n- CVE-2026-81665: heap buffer overflow in totempg_deliver_fn()","status":"published","published":"2026-10-21T14:08:44Z","modified":"2026-10-26T09:31:43.908246324Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792622946","title":"corosync: Fix of 4 CVEs","description":"- CVE-2025-30472: stack buffer overflow in orf_token_endian_convert()\n- CVE-2026-35091: out-of-bounds read via check_memb_commit_token_sanity()\n- CVE-2026-35092: integer overflow in check_memb_join_sanity()\n- CVE-2026-81665: heap buffer overflow in totempg_deliver_fn()","status":"published","published":"2026-10-21T22:49:17Z","modified":"2026-10-26T09:31:52.281856784Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"DLA-4308-1","title":"corosync - security update","status":"published","published":"2025-09-22T00:00:00Z","modified":"2026-03-09T02:10:14.617471Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0127","title":"Updated corosync packages fix security vulnerability","description":"Corosync through 3.1.9, if encryption is disabled or the attacker knows\nthe encryption key, has a stack-based buffer overflow in\norf_token_endian_convert in exec/totemsrp.c via a large UDP packet.\n(CVE-2025-30472)\n","status":"published","published":"2025-04-05T18:46:57Z","modified":"2026-04-16T04:43:37.47710393Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:14933-1","title":"corosync-3.1.9-2.1 on GA media","description":"These are all security issues fixed in the corosync-3.1.9-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-27T00:00:00Z","modified":"2026-02-04T02:13:57.640738Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:1084-1","title":"Security update for corosync","description":"This update for corosync fixes the following issues:\n\n- CVE-2025-30472: Fixed stack buffer overflow from 'orf_token_endian_convert' (bsc#1239987)\n","status":"published","published":"2025-04-01T10:19:03Z","modified":"2026-02-04T03:35:08.011576Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-7478-1","title":"corosync vulnerability","description":"It was discovered that Corosync incorrectly handled certain large UDP\npackets. If encryption is disabled, or an attacker knows the encryption\nkey, this issue could be used to cause Corosync to crash, resulting in a\ndenial of service.\n","status":"published","published":"2025-05-05T12:05:14Z","modified":"2026-04-27T17:57:00.876353Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}