2,507 results · Clear filters · Feed
-
High max 8.5ALAS2-2026-4014 9 CVEs
Important: xorg-x11-server security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-93524: CheckKeySyms() in xkb/xkb.c populates a symsPerKey[] validation array with new key widths for keys in the SetMap request range, then continues filling ent…
-
High max 8.5ALAS2-2026-4013 9 CVEs
Important: tigervnc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-93524: CheckKeySyms() in xkb/xkb.c populates a symsPerKey[] validation array with new key widths for keys in the SetMap request range, then continues filling ent…
-
High max 7.1ALAS2-2026-4012 1 CVE
Important: libXtst security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-94286: An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.
-
High max 7.5ALAS2-2026-4011 1 CVE
Important: python-tornado security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-103262: Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial …
-
High max 8.6ALAS2-2026-4010 1 CVE
Important: mod_security security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-104269: GHSA-5pww-8rfg-9crf: RFC 2231 filename* parameter bypasses multipart filename rules
-
High max 8.2ALAS2-2026-4007 4 CVEs
Important: edk2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-84782: A flaw was found in OpenSSL. The Datagram Transport Layer Security (DTLS) retransmission mechanism fails to properly handle handshake message writes that …
-
High max 8.1ALAS2-2026-4006 3 CVEs
Important: wireshark security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-96423: The X11 dissector caches, per TCP conversation, one keysym array per keycode in x11_conv_data_t.keycodemap[256]. Each array is allocated in listOfKeysyms(…
-
High max 9.1ALAS2-2026-4005 14 CVEs
Important: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-97032: HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK enc…
-
High max 7.0ALAS2-2026-4004 4 CVEs
Important: gfs2-utils security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-71222: A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds…
-
High max 9.0ALAS2-2026-4003 2 CVEs
Important: 389-ds-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-86345: A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing…
-
High max 9.2
Important: brotli security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-111497: A vulnerability in the Node.js Brotli decoder can result in an out-of-bounds memory write when processing crafted Brotli input. Successful exploitatio…
-
High max 7.5ALAS2023-2026-3333 1 CVE
Important: amazon-efs-utils security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-15957: Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS S…
-
High max 7.5ALAS2023-2026-3328 11 CVEs
Important: nodejs22 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-87018: undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process cras…
-
High max 7.5ALAS2023-2026-3322 4 CVEs
Important: git-lfs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-94440: Parsing a multipart form could bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part was l…
-
High max 7.5ALAS2023-2026-3321 1 CVE
Important: ecs-init security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-78659: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server…
-
High max 8.1ALAS2023-2026-3312 6 CVEs
Important: bind security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-97313: Named exits on an assertion failure, resulting in denial of service. Affected versions: 9.16.0-9.18.50, 9.20.0-9.20.29. CVE-2026-96888: Named may termi…
-
High max 8.8ALAS2023-2026-3307 56 CVEs
Important: freerdp security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-111881: FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to …
-
High max 7.5ALAS2023-2026-3305 5 CVEs
Important: jackson-databind security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-91777: Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator…
-
High max 6.5ALAS2023-2026-3300 2 CVEs
Important: nginx-mod-njs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-101025: Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failur…
-
High max 9.1ALAS2023-2026-3298 9 CVEs
Important: python-jwt security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-102275: PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected be…
-
High max 7.7ALAS2023-2026-3297 5 CVEs
Important: nodejs24 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-73566: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to …
-
High max 7.7ALAS2023-2026-3296 2 CVEs
Important: python3.13-virtualenv security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-102938: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-o…
-
High max 7.7ALAS2023-2026-3295 2 CVEs
Important: python-virtualenv security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-102938: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-o…
-
High max 9.8ALAS2023-2026-3294 3 CVEs
Important: ghostscript security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-39919: Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attac…
-
High max 7.5ALAS2023-2026-3293 1 CVE
Important: python3.13-tornado security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-103262: Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause deni…
-
High max 7.5ALAS2023-2026-3292 1 CVE
Important: python-tornado security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-103262: Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause deni…
-
High max 7.8ALAS2023-2026-3291 1 CVE
Important: cifs-utils security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-104715: A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common…
-
High max 7.5ALAS2023-2026-3290 1 CVE
Important: cyrus-sasl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-107161: A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer ne…
-
High max 8.4ALAS2023-2026-3289 1 CVE
Important: mariadb1011 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM pa…
-
High max 8.4ALAS2023-2026-3288 1 CVE
Important: mariadb114 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM pa…
-
High max 8.4ALAS2023-2026-3287 1 CVE
Important: mariadb118 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM pa…
-
High max 8.4ALAS2023-2026-3286 1 CVE
Important: mariadb123 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-107814: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM pa…
-
High max 9.6ALAS2023-2026-3281 62 CVEs
Important: firefox security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-109783: Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5. CVE-2026-109782: Mitigation bypass in the File Ha…
-
High max 7.6ALAS2023-2026-3278 1 CVE
Important: python3.9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-19553: ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing paramet…
-
High max 7.5ALAS2023-2026-3277 5 CVEs
Important: nodejs22 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-73566: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to …
-
High max 5.9ALAS2023-2026-3275 4 CVEs
Important: aspell security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-75820: GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a per…
-
High max 9.1ALAS2023-2026-3274 4 CVEs
Important: nerdctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-78663: The HTTP/2 server could refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-b…
-
High max 9.1ALAS2023-2026-3273 8 CVEs
Important: containerd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-95837: containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable bec…
-
High max 9.1ALAS2023-2026-3272 7 CVEs
Important: oci-add-hooks security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-97030: A trusted template author may have previously written a valid template wherein the use of the |yield| keyword would not be correctly escaped. We now en…
-
High max 9.1ALAS2023-2026-3271 7 CVEs
Important: amazon-ecr-credential-helper security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-97030: A trusted template author may have previously written a valid template wherein the use of the |yield| keyword would not be correctly escaped. We now en…