Summary
It was discovered that Corosync incorrectly handled certain large UDP
packets. If encryption is disabled, or an attacker knows the encryption
key, this issue could be used to cause Corosync to crash, resulting in a
denial of service.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | corosync | 3.0.3-2ubuntu2.2 |
| Ubuntu · 22.04 LTS 22.04:LTS | corosync | 3.1.6-1ubuntu1.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | corosync | 3.1.7-1ubuntu3.1 |
Vulnerabilities 1
-
Critical 9.0
Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer ov…
References
-
report
https://ubuntu.com/security/CVE-2025-30472