Skip to content
OpenAdvisories
High ALAS2023-2026-3233 1 CVE

Important: mount-s3 security update (Amazon Linux 2023)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-12043: Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to cause memory corruption on a connecting client application, potentially leading to arbitrary code execution, via a crafted sequence of HTTP/2 HEADERS frames. To remediate this issue, users should upgrade to aws-c-http version 0.11.0.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2023 mount-s3 0:1.23.0-1.amzn2023
Amazon Linux · 2023 mount-s3-debuginfo 0:1.23.0-1.amzn2023
Amazon Linux · 2023 mount-s3-debugsource 0:1.23.0-1.amzn2023

Vulnerabilities 1

  • High 8.8
    CVE-2026-12043

    Heap double-free in AWS Common Runtime aws-c-http

    Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to cause memory corruption on a connecting client application, potentially leading to arbitrary code execut…

    AWS aws-c-http

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-12043.html