Vendors / Corosync Records 5 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 3
Exploited now Corosync records in CISA KEV No Corosync vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 76
Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00469 · Published 2025-03-22 · Partial fix CWE-121
Priority MEDIUM 43
A flaw was found in Corosync.
CVSS 3.1 HIGH 8.2· Network · No auth · No interaction · EPSS 0.00883 · Published 2026-04-01 · Fixed in 3.1.9-2.el10_1.1, 3.1.10-1.el10_2.1 +12 CWE-253
Priority MEDIUM 41
A flaw was found in Corosync.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01012 · Published 2026-04-01 · Fixed in 3.1.9-2.el10_1.1, 3.1.10-1.el10_2.1 +12 CWE-190
Priority LOW 38
corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.03113 · Published 2018-04-12 · Partial fix CWE-190
Priority LOW 28
The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize the HMAC key, which allows remote attackers to cause a denial of service (crash) via a crafted packet.
CVSS 2.0 MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.03077 · Published 2014-06-06 · No fix listed
Open these records in search → All records by CVSS severity
1 3 1 0 0
THREATIST.IORead the docs