I am pleased to announce that the latest maintenance release, Corosync 3.2.0, is available immediately from the GitHub release section at https://github.com/corosync/corosync/releases.
This release contains important bug fixes and improvements. The most notable changes (in commit date order) are: - Fixed CVE-2026-35091, CVE-2026-35092, CVE-2026-81666 and CVE-2026-81665. As with previous CVEs, if you use encryption and/or a trusted network, you are protected. - Added a new API for storing extra information in votequorum. See the man pages for votequorum_get_qdevice_extra_info(3), votequorum_set_qdevice_extra_info(3) and votequorum_model_initialize(3) for usage details. This introduces a bump to the library soname, but the API and ABI remain fully backward compatible. - The service sync abort callback is now correctly called during the barrier phase. This is a highly important fix; if you have been observing stalled behavior during synchronization (such as ghost cluster members), this patch should solve the problem. - Encryption is now enforced at compile time. More information about this change is included in the commit itself (65f9450829de5c9c3164e5196b2887cb08308637), the proposal PR (https://github.com/corosync/corosync/pull/821) and the mailing list (https://lists.clusterlabs.org/pipermail/users/2026-May/036727.html). This primarily changes the default configuration. If you still rely on unencrypted Corosync and/or the legacy UDPU transport, it is still possible to enable them via the --enable-unencrypted and --enable-udpu configure flags. This shift in default security is the primary reason for bumping the minor version. - Dynamically fetch cipher and hash lists. The cipher/hash lists are now fetched directly from knet (or a hardcoded list if knet support is not available). These are now displayed in the corosync -v output and properly validated during configuration parsing. - Removed the Zero-Copy CPG. We were unable to find any users of this API and because it was unfinished and seriously flawed, we decided to remove it entirely. Backward compatibility for existing applications is kept, as the standard CPG API is now used seamlessly as a fallback. - Fixed an issue with knet ping timers where the token timeout was incorrectly calculated during a configuration reload. - Fixed Rust bindings so that bindgen generated files now contain only the required types and functions, rather than pulling in the almost entire standard C library. Complete changelog for 3.2.0: Andrew Price (1): .gitignore: Ignore cscope.out Christine Caulfield (1): CPG: Remove zero-copy CPG Dina Tagantseva (1): vqsim: Check partition number is in range Fabio M. Di Nitto (2): use #include <poll.h> consistently totemknet: Add KNET_IOV_LEN_MAX Jan Friesse (19): testsam: Initialize err testcfg: Pass pointer to phtread coroparse: Do not format too long path main: Remove discards const qualifier warnings rust: Allow trailing nul in CPG names totemconfig: Fix knet ping timer calc on reload totemsrp: Return error if sanity check fails totemsrp: Fix integer overflow in memb_join_sanity totemknet: Warn if ip_dscp option is unsupported Enforce encryption at compile time util: Refactor util_is_valid_knet_*_model crypto: Support for knet_get_crypto_cipher_list crypto: Support for knet_get_crypto_hash_list quorum: Fix inconsistent union access warning cpg: Fix inconsistent union access warning totemsrp: Fix int overflow in commit_token_sanity totempg: Replace assert with check in deliver_fn rust: Fix warnings issued by newer rustc votequorum: Don't segfault when callbacks is NULL MichalM132 (1): cfgtool: Fix typo Shannon Sterz (1): man: document knet_link_priority behaviour for 0 and 1 Thomas Jones (1): Add qdevice extra info to votequorum Thomas Lamprecht (1): sync: Call service abort cb also in barrier phase statzitz (1): init: Add openrc init script Upgrade is highly recommended. Thanks/congratulations to all people that contributed to achieve this great milestone. _______________________________________________ Manage your subscription: https://lists.clusterlabs.org/mailman/listinfo/users ClusterLabs home: https://www.clusterlabs.org/
