The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4608 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4608-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Emmanuel Arias     May 30, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : corosync     Version        : 3.1.2-2+deb11u2     CVE ID         : CVE-2026-35091 CVE-2026-35092     Debian Bug     : 1133837 1133838


    Two vulnerabilities have been found in corosync, a cluster engine daemon and     utilities, that allow a remote, unauthenticated attacker to cause a denial of     service.

    CVE-2026-35091

        A remote unauthenticated attacker can exploit a wrong return value         vulnerability in the Corosync membership commit token sanity check by         sending a specially crafted User Datagram Protocol (UDP) packet. This can         lead to an out-of-bounds read, causing a denial of service (DoS) and         potentially disclosing limited memory contents.

    CVE-2026-35092

        An integer overflow vulnerability in Corosync's join message sanity         validation allows a remote, unauthenticated attacker to send crafted User         Datagram Protocol (UDP) packets. This can cause the service to crash,         leading to a denial of service.

    For Debian 11 bullseye, these problems have been fixed in version     3.1.2-2+deb11u2.

    We recommend that you upgrade your corosync packages.

    For the detailed security status of corosync please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/corosync

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_13644 advisory.

    * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091)

    * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_13673 advisory.

    * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091)

    * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19043 advisory.

    - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091)
    - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792591710 advisory.

  - Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-     based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.
    (CVE-2025-30472)

  - A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value     vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User     Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS)     and potentially disclosing limited memory contents (CVE-2026-35091)

  - A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity     validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets.
    This can cause the service to crash, leading to a denial of service. This vulnerability specifically     affects Corosync deployments configured to use totemudp/totemudpu mode. (CVE-2026-35092)

  - A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly.
    When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime     bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol     messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash     the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further     exploitation given sufficient heap-corruption control. (CVE-2026-81665)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
318003	Debian dla-4608 : corosync - security update	Nessus	Debian Local Security Checks	2026/5/30	2026/5/30	high
353892	Rocky Linux 10.1 [CIQ] Security Update: corosync-debuginfo / corosync-debugsource / corosync-vqsim / etc Multiple Vulnerabilities (crlsa-2026_13644)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
356011	Rocky Linux 9 [CIQ] Security Update: corosync / corosync-debuginfo / corosync-debugsource / etc Multiple Vulnerabilities (crlsa-2026_13673)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
327035	Oracle Linux 10 : corosync (ELSA-2026-19043)	Nessus	Oracle Linux Local Security Checks	2026/7/15	2026/7/15	high
369964	CentOS Linux 8.4 [TuxCare] Security Update: corosync / corosync-vqsim / corosynclib / corosynclib-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792591710)	Nessus	CentOS Local Security Checks	2026/10/21	2026/10/21	critical

检测

插件搜索

high

high

high

high

critical