Skip to content
OpenAdvisories
Medium ALAS2-2026-3225 1 CVE

Moderate: rust security update (Amazon Linux 2)

Published Mar 30, 2026 · Updated Apr 1, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-32829: Decompressing invalid LZ4 data can leak data from uninitialized memory, or can leak content from previous decompression operations when reusing an output buffer.

Fixed packages 12

ReleasePackageFixed in
Amazon Linux · 2 cargo 0:1.93.0-1.amzn2.0.1
Amazon Linux · 2 clippy 0:1.93.0-1.amzn2.0.1
Amazon Linux · 2 rust 0:1.93.0-1.amzn2.0.1
Amazon Linux · 2 rust-analyzer 0:1.93.0-1.amzn2.0.1
Amazon Linux · 2 rust-debugger-common 0:1.93.0-1.amzn2.0.1
Amazon Linux · 2 rust-doc 0:1.93.0-1.amzn2.0.1
Amazon Linux · 2 rust-gdb 0:1.93.0-1.amzn2.0.1
Amazon Linux · 2 rust-src 0:1.93.0-1.amzn2.0.1
Amazon Linux · 2 rust-std-static 0:1.93.0-1.amzn2.0.1
Amazon Linux · 2 rust-toolset 0:1.93.0-1.amzn2.0.1
Amazon Linux · 2 rust-toolset-srpm-macros 0:1.93.0-1.amzn2.0.1
Amazon Linux · 2 rustfmt 0:1.93.0-1.amzn2.0.1

Vulnerabilities 1

  • High 8.2
    CVE-2026-32829

    lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer

    lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library f…

    PSeitz lz4_flex qdrant vector Debian Ubuntu Wolfi crates.io

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-32829.html