Skip to content
OpenAdvisories
High ALAS2-2026-3387 1 CVE

Important: perl-GD security update (Amazon Linux 2)

Published Jun 22, 2026 · Updated Jun 22, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-11526: command injection via 2-arg open() in _make_filehandle

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 perl-GD 0:2.49-3.amzn2.0.3
Amazon Linux · 2 perl-GD-debuginfo 0:2.49-3.amzn2.0.3

Vulnerabilities 1

  • Critical 9.8
    CVE-2026-11526

    GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle

    GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle. GD::Image::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with…

    RURBAN GD libgd-perl perl-gd Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-11526.html