CVE-2025-30472
EUVD-2025-719822.03.2025, 02:15
Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| corosync | corosync | 𝑥 ≤ 3.1.9 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| corosync |
|
Red Hat Enterprise Linux Releases
Amazon Linux Releases
Amazon Package | |||
|---|---|---|---|
| corosync |
| ||
| corosync-debuginfo |
| ||
| corosync-qdevice |
| ||
| corosync-qnetd |
| ||
| corosynclib |
| ||
| corosynclib-devel |
| ||
| spausedd |
|
Common Weakness Enumeration
- CWE-121 - Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
- CWE-787 - Out-of-bounds WriteThe software writes data past the end, or before the beginning, of the intended buffer.