Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-42499: Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. CVE-2026-39823: CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS. CVE-2026-39820: Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. CVE-2026-33814: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. CVE-2026-33811: When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. CVE-2026-27142: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | cri-tools | 0:1.32.0-1.amzn2.0.6 |
| Amazon Linux · 2 | cri-tools-debuginfo | 0:1.32.0-1.amzn2.0.6 |
Vulnerabilities 6
-
High 7.5
Crash when handling long CNAME response in net
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
-
High 7.5
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
-
High 7.5
Quadratic string concatentation in consumeComment in net/mail
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
-
High 7.5
Quadratic string concatenation in consumePhrase in net/mail
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
-
Medium 6.1
URLs in meta content attribute actions are not escaped in html/template
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be …
-
Medium 6.1
Bypass of meta content URL escaping causes XSS in html/template
CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to si…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-27142.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-33811.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-33814.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-39820.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-39823.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-42499.html