ALAS2-2026-4084 — Moderate: p11-kit security update (Amazon Linux 2)

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-18938: P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems

Fixed packages 5

Release	Package	Fixed in
Amazon Linux · 2	p11-kit	0:0.23.22-1.amzn2.0.2
Amazon Linux · 2	p11-kit-debuginfo	0:0.23.22-1.amzn2.0.2
Amazon Linux · 2	p11-kit-devel	0:0.23.22-1.amzn2.0.2
Amazon Linux · 2	p11-kit-server	0:0.23.22-1.amzn2.0.2
Amazon Linux · 2	p11-kit-trust	0:0.23.22-1.amzn2.0.2

Vulnerabilities 1

Medium 6.2

CVE-2026-18938

P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems

A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocatio…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux

Aug 7, 2026

References

web
https://alas.aws.amazon.com/cve/html/CVE-2026-18938.html