Skip to content
OpenAdvisories

Source

Amazon Linux Security Center (ALAS)

Source: https://alas.aws.amazon.com/

All Critical High Medium Low With exploited CVEs

2,507 results · Clear filters · Feed

  • High max 7.5
    ALAS2023-2026-3378 5 CVEs

    Important: amazon-efs-utils security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-93601: rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtre…

  • High max 7.5
    ALAS2023-2026-3375 3 CVEs

    Important: aws-workload-credentials-provider security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-93601: rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtre…

  • High max 9.1
    ALAS2023-2026-3320 46 CVEs

    Important: java-25-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.…

    first Oct 26, 2026
  • High max 9.1
    ALAS2023-2026-3319 46 CVEs

    Important: java-21-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.…

    first Oct 26, 2026
  • High max 9.1
    ALAS2023-2026-3318 46 CVEs

    Important: java-17-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.…

    first Oct 26, 2026
  • High max 9.1
    ALAS2023-2026-3317 46 CVEs

    Important: java-11-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.…

    first Oct 26, 2026
  • High max 9.1
    ALAS2023-2026-3316 43 CVEs

    Important: java-27-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.…

    first Oct 26, 2026
  • High max 9.1
    ALAS2023-2026-3315 46 CVEs

    Important: java-1.8.0-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.…

    first Oct 26, 2026
  • High max 9.1
    ALAS2-2026-4040 46 CVEs

    Important: java-17-amazon-corretto security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.…

    first Oct 26, 2026
  • High max 9.1
    ALAS2-2026-4039 46 CVEs

    Important: java-11-amazon-corretto security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.…

    first Oct 26, 2026
  • High max 7.8
    ALAS2-2026-3808 5 CVEs

    Important: rust security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-82255: gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-con…

    first Jul 20, 2026
  • High max 9.8
    ALAS2023-2026-3335 272 CVEs

    Important: kernel6.12 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-99088: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in set_ipv6_addr CVE-2026-9908…

  • High max 7.6
    ALAS2023-2026-3266 11 CVEs

    Important: docker security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-94440: Parsing a multipart form could bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part was l…

    first Oct 26, 2026
  • High max 7.5
    ALAS2023-2026-3181 8 CVEs

    Important: rust-cargo-c security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-82255: gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-…

    first Oct 12, 2026
  • High max 7.8
    ALAS2023-2026-2147 3 CVEs

    Important: emacs security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-96269: GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the inter…

    first Sep 14, 2026
  • High max 7.8
    ALAS2023-2026-1951 4 CVEs

    Important: rust security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-82255: gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-…

    first Jul 20, 2026
  • High max 9.1
    ALAS2-2026-4067 1 CVE

    Important: java-11-amazon-corretto security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported ver…

  • High max 9.1
    ALAS2-2026-4066 1 CVE

    Important: java-17-amazon-corretto security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported ver…

  • High max 9.8
    ALAS2-2026-4065 1 CVE

    Important: kernel security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-98432: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period

  • High max 7.5
    ALAS2-2026-4062 1 CVE

    Important: python-dns security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-114605: dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop…

  • High max 8.1
    ALAS2-2026-4061 1 CVE

    Important: ImageMagick security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-116149: A flaw was found in ImageMagick. A stack-based buffer overflow vulnerability exists in the handling of bzip2 compressed images, where stack memory can be…

  • High max 8.7
    ALAS2-2026-4060 1 CVE

    Important: qt5-qtbase security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-16762: An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, maki…

  • High max 9.6
    ALAS2-2026-4057 72 CVEs

    Important: thunderbird security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-93990: Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attack…

  • High max 9.1
    ALAS2-2026-4049 3 CVEs

    Important: amazon-cloudwatch-agent security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-78663: The HTTP/2 server could refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-…

  • High max 9.8
    ALAS2-2026-4048 6 CVEs

    Important: perl-Text-CSV_XS security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-110759: Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the i…

  • High max 9.5
    ALAS2-2026-4047 1 CVE

    Important: edk2 security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-97631: EDK2 contains a vulnerability in BIOS where a user may cause "Out-of-bounds Write", Classic Buffer Overflow, and "Incorrect Calculation of Buffer Size" by…

  • High max 7.8
    ALAS2-2026-4046 1 CVE

    Important: emacs security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-108976: GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed…

  • High max 8.1
    ALAS2023-2026-3374 2 CVEs

    Important: dotnet9.0 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-70197: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-114148: Incorrect default permissions in ASP.NET C…

  • High max 9.1
    ALAS2023-2026-3373 1 CVE

    Important: java-1.8.0-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …

  • High max 9.1
    ALAS2023-2026-3372 1 CVE

    Important: java-11-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …

  • High max 9.1
    ALAS2023-2026-3371 1 CVE

    Important: java-17-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …

  • High max 9.1
    ALAS2023-2026-3370 1 CVE

    Important: java-21-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …

  • High max 9.1
    ALAS2023-2026-3369 1 CVE

    Important: java-25-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …

  • High max 9.1
    ALAS2023-2026-3368 1 CVE

    Important: java-27-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …

  • High max 9.2
    ALAS2023-2026-3367 25 CVEs 1 exploited

    Important: dotnet8.0 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-96960: Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-96959: Allocation of r…

  • High max 8.8
    ALAS2023-2026-3366 24 CVEs

    Important: dotnet10.0 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-96960: Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-96959: Allocation of r…

  • High max 9.8
    ALAS2023-2026-3365 1 CVE

    Important: kernel security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-98432: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period

  • High max 7.5
    ALAS2023-2026-3357 1 CVE

    Important: python-dns security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-114605: dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a …

  • High max 9.8
    ALAS2023-2026-3353 4 CVEs

    Important: gstreamer1-plugins-good security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-88914: A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption d…

  • High max 9.1
    ALAS2023-2026-3352 9 CVEs

    Important: perl-Cpanel-JSON-XS security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-110686: Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies t…