Skip to content
OpenAdvisories
High ALAS2023-2026-2073 1 CVE

Important: swiftlang security update (Amazon Linux 2023)

Published Aug 31, 2026 · Updated Aug 31, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-43823: When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2023 swiftlang 0:6.3-1.amzn2023.0.2
Amazon Linux · 2023 swiftlang-lib 0:6.3-1.amzn2023.0.2

Vulnerabilities 1

  • High 7.5
    CVE-2026-43823

    When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the …

    Apple swift-crypto

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-43823.html