Skip to content
OpenAdvisories
High ALAS2023-2026-2023 5 CVEs

Important: runfinch-finch security update (Amazon Linux 2023)

Published Aug 3, 2026 · Updated Aug 4, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-49835: A flaw was found in Sigstore Timestamp Authority. An unauthenticated remote attacker can exploit this vulnerability by sending requests with arbitrary HTTP paths and methods. This leads to the creation of an excessive number of unique metric labels, causing unbounded memory growth and a denial of service (DoS) condition on the server. This issue is a type of Improper Restriction of Resource Consumption (CWE-770). CVE-2026-49478: A flaw was found in Fulcio's OpenID Connect (OIDC) Discovery client. This vulnerability allows a remote attacker to perform Server-Side Request Forgery (SSRF) by redirecting discovery requests to internal systems. Additionally, an attacker can manipulate the JSON Web Key Set (JWKS) Uniform Resource Identifier (URI) to poison the verifier cache with malicious keys, enabling the validation of attacker-controlled signatures. Furthermore, the flaw can lead to the leakage of Kubernetes ServiceAccount tokens to third-party hosts through cross-host redirects or misconfigured MetaIssuers, potentially exposing sensitive cluster credentials. CVE-2026-48702: A flaw was found in Rekor. The `Package.Unmarshal()` function, which processes Alpine Package Keep (APK) files, decompresses gzip streams without limiting the total decompressed size. A remote attacker can exploit this by crafting a malicious APK file with a high compression ratio, causing the server to consume excessive memory. This leads to a Denial of Service (DoS) through an out-of-memory (OOM) error, and can be triggered via unauthenticated API endpoints. CVE-2026-42505: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-39822: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 runfinch-finch 0:1.17.2-1.amzn2023.0.3

Vulnerabilities 5

  • High 8.7
    CVE-2026-49478

    Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

    Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a maliciou…

    sigstore fulcio kubescape kots Debian Ubuntu Wolfi Go
  • High 7.8
    CVE-2026-39822

    Root escape via symlink plus trailing slash in os

    On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even whe…

    Go standard library os katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-48702

    Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

    Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers …

    sigstore rekor kubescape zarf Debian Ubuntu Wolfi Go
  • Medium 5.9
    CVE-2026-49835

    Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality

    Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metri…

    sigstore timestamp-authority kubescape zarf Debian Ubuntu Wolfi Go
  • Medium 5.3
    CVE-2026-42505

    Invoking Encrypted Client Hello privacy leak in crypto/tls

    Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

    Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-39822.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-42505.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48702.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-49478.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-49835.html