Hi,

The following vulnerabilities were published for corosync.

CVE-2026-81665[0]:
| A heap-based buffer overflow was found in Corosync's Totem Process
| Group (totempg) message reassembly. When processing fragmented
| multicast messages, the buffer used to reassemble fragments lacks a
| runtime bounds check in release builds. A network-adjacent attacker
| able to send crafted multicast protocol messages to the cluster
| could cause a heap buffer overflow with attacker-controlled data.
| This can crash the Corosync daemon, causing a denial of service to
| the entire cluster, and may potentially allow further exploitation
| given sufficient heap-corruption control.


CVE-2026-81666[1]:
| An integer overflow was found in Corosync's handling of membership
| commit token messages. The length-validation check for these
| messages can be bypassed on 32-bit systems due to an integer
| overflow in the calculation of the expected message length, allowing
| a crafted network packet to trigger an out-of-bounds memory access
| that crashes the Corosync daemon. This results in a denial of
| service for the affected cluster node. The overflow does not occur
| on 64-bit systems, where the length calculation is correctly
| performed in 64-bit arithmetic.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-81665
https://www.cve.org/CVERecord?id=CVE-2026-81665
https://github.com/corosync/corosync/commit/5148bf07dffa61bcfa92ca2c058e7d0f0a981cf3
[1] https://security-tracker.debian.org/tracker/CVE-2026-81666
https://www.cve.org/CVERecord?id=CVE-2026-81666
https://github.com/corosync/corosync/commit/83920f2e36b5f1acd7dcf033c0820043cc29f82a

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore