Skip to content
OpenAdvisories
High ALAS2-2026-4031 1 CVE

Important: lrzsz security update (Amazon Linux 2)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-105841: lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 lrzsz 0:0.12.20-36.amzn2.0.3
Amazon Linux · 2 lrzsz-debuginfo 0:0.12.20-36.amzn2.0.3

Vulnerabilities 1

  • High 7.5
    CVE-2026-105841

    lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode

    lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lr…

    Uwe Ohse lrzsz lrzsz lrzsz Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-105841.html