Skip to content
OpenAdvisories
High ALAS2023-2026-1893 1 CVE

Important: ecs-service-connect-agent security update (Amazon Linux 2023)

Published Jun 22, 2026 · Updated Jun 22, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-47774: A denial-of-service vulnerability was found in Envoy's HTTP/2 HPACK header compression implementation. A remote attacker could send a specially crafted HTTP/2 request that triggers disproportionately large memory allocations on the server, leading to resource exhaustion and denial of service.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 ecs-service-connect-agent 0:v1.34.13.2-1.amzn2023

Vulnerabilities 1

  • High 7.5
    CVE-2026-47774

    Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 downstream request processing allows an unauthenticated remote client to trigger ex…

    envoyproxy envoy

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-47774.html