Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42499: Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. CVE-2026-39823: CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS. CVE-2026-39820: Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. CVE-2026-33814: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. CVE-2026-33811: When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | rclone | 0:1.73.5-76.amzn2023 |
| Amazon Linux · 2023 | rclone-debuginfo | 0:1.73.5-76.amzn2023 |
| Amazon Linux · 2023 | rclone-debugsource | 0:1.73.5-76.amzn2023 |
Vulnerabilities 5
-
High 7.5
Crash when handling long CNAME response in net
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
-
High 7.5
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
-
High 7.5
Quadratic string concatentation in consumeComment in net/mail
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
-
High 7.5
Quadratic string concatenation in consumePhrase in net/mail
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
-
Medium 6.1
Bypass of meta content URL escaping causes XSS in html/template
CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to si…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-33811.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-33814.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-39820.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-39823.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-42499.html