[CLSA-2026:1790008457] corosync: Fix of CVE-2026-81665
Type:
security
Severity:
Important
Release date:
2026-09-21 16:34:27 UTC
Description:
- CVE-2026-81665: replace the assert in totempg_deliver_fn with a runtime bounds check so an oversized fragmented message is logged and ignored instead of overflowing the assembly reassembly buffer when asserts are compiled out
CVEs fixed:
Updated packages:
  • corosync-3.1.9-2.el9_6.tuxcare.els2.x86_64.rpm
    sha:34fd1fa1335f398fa7e081b2548f33512bb01cd6d8edca1fd5c844feb52e6805
  • corosync-vqsim-3.1.9-2.el9_6.tuxcare.els2.x86_64.rpm
    sha:1b7b5f8f2df8a954c6abcb2e49f8ecc6b29e8d499b521fd894cdbb3fa034191d
  • corosynclib-3.1.9-2.el9_6.tuxcare.els2.i686.rpm
    sha:e38d35ceecf47b24f0ac6f9f8811dc5af2d5f08d124c38baeb05d247816091da
  • corosynclib-3.1.9-2.el9_6.tuxcare.els2.x86_64.rpm
    sha:fb556f356c378052963786ff06c82a516aa7eb3a2d9d1e7e7538b7fea5ad12cd
  • corosynclib-devel-3.1.9-2.el9_6.tuxcare.els2.i686.rpm
    sha:b98643f59a6130ed044f06dbb238bee688b6695d08291313af60123fa53e6ac0
  • corosynclib-devel-3.1.9-2.el9_6.tuxcare.els2.x86_64.rpm
    sha:e8d5e966151c74d280af9cfcbe4eb2dd2d3da8d424c3827cf31d684163112f24
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.