Skip to content
OpenAdvisories
Medium ALAS2-2026-3378 1 CVE

Moderate: amazon-ssm-agent security update (Amazon Linux 2)

Published Jun 22, 2026 · Updated Jun 22, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-41506: go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2 amazon-ssm-agent 0:3.3.4624.0-1.amzn2

Vulnerabilities 1

  • Medium 4.7
    CVE-2026-41506

    go-git Credential leak via cross-host redirect in smart HTTP transport

    go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patch…

    go-git go-git zot kubescape Debian Ubuntu Wolfi Go

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-41506.html