Red Hat Security Advisory

RHSA-2025:7478

corosync security update

Released 2025-05-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) corosync-3.1.9-1.el10_0.1, corosynclib-3.1.9-1.el10_0.1
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) corosync-vqsim-3.1.9-1.el10_0.1
Red Hat Enterprise Linux High Availability (v. 10) corosync-3.1.9-1.el10_0.1, corosynclib-devel-3.1.9-1.el10_0.1

Fixes 1 record

TI-2025-21772 CVE-2025-30472 · GHSA-4q2r-xgxr-vvqm

Stack-based buffer overflow in Corosync

HIGH 76

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00469 Published 2025-03-22 Partial fix CWE-121