CVE-2026-35091
Redhat Enterprise Linux 10.0 … 9.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:HSummary
CVE-2026-35091 is a high-severity Incorrect Check of Function Return Value (CWE-253) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 8.2 (High).
Operationally, ranked in the top 45% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-35091 is a wrong return value vulnerability in the Corosync membership commit token sanity check. A remote unauthenticated attacker can exploit it by sending a specially crafted User Datagram Protocol (UDP) packet, triggering an out-of-bounds read. This flaw affects Corosync when running in its default totemudp/totemudpu mode and can result in a denial of service (DoS) or the disclosure of limited memory contents. The vulnerability has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) and is associated with CWE-253.
A remote unauthenticated attacker with network access to a vulnerable Corosync instance can exploit this issue without requiring privileges or user interaction. Exploitation involves transmitting a malicious UDP packet that bypasses the sanity check, leading to an out-of-bounds read. This primarily causes a DoS by crashing the service due to high availability impact, while potentially leaking limited memory contents as reflected in the low confidentiality score.
Red Hat advisories provide mitigations through patches in errata RHSA-2026:13644, RHSA-2026:13657, and RHSA-2026:13673. Further details on the vulnerability and remediation are documented on the Red Hat security page at https://access.redhat.com/security/cve/CVE-2026-35091 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2453169.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17879
Vulnerability Data
A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an…
more
out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and code analysis can discover missing or incorrect return-value checks.
Documented development standards and tools can mandate verified checking of every function return value.
Security engineering principles include requirements for robust error checking of all function returns.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce proper error-handling and return-value checking during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches missing or incorrect return-value checks.
Secure SDLC mandates return-value checks and error handling, directly reducing CWE-253.
Application security requirements include robust error handling that mitigates incorrect return-value checks.
Secure architecture principles require defensive coding practices such as validating function results.
Secure coding explicitly demands checking return values, covering most of CWE-253.