Skip to content
OpenAdvisories

Source

Amazon Linux Security Center (ALAS)

Source: https://alas.aws.amazon.com/

All Critical High Medium Low With exploited CVEs

2,033 results · Clear filters · Feed

  • Medium max 6.9
    ALAS2023-2026-1425 1 CVE

    Moderate: expat security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-25210: In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag…

    first Feb 16, 2026
  • Medium max 6.9
    ALAS2023-2026-1424 1 CVE

    Moderate: firefox security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-25210: In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag…

    first Feb 16, 2026
  • Medium max 9.1
    ALAS2023-2026-1419 4 CVEs

    Moderate: runc security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate…

    first Feb 16, 2026
  • Medium max 6.3
    ALAS2023-2026-1411 2 CVEs

    Moderate: python3.13-filelock security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-22701: filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock impl…

    first Feb 16, 2026
  • Medium max 6.3
    ALAS2023-2026-1398 1 CVE

    Moderate: log4j security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68161: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even whe…

    first Feb 16, 2026
  • Medium max 9.1
    ALAS2023-2026-1376 4 CVEs

    Moderate: docker security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate…

    first Feb 16, 2026
  • Medium max 4.3
    ALAS2-2026-3157 1 CVE

    Moderate: rsync security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-10158: A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. …

  • Medium max 8.9
    ALAS2-2026-3156 2 CVEs

    Moderate: python-urllib3 security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-66471: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compres…

  • Medium max 5.9
    ALAS2-2026-3144 2 CVEs

    Moderate: libxml2 security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-0992: A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <ne…

  • Medium max 4.8
    ALAS2-2026-3133 1 CVE

    Moderate: capstone security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-67873: Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can m…

  • Medium max 6.3
    ALAS2023-2026-1415 2 CVEs

    Moderate: python-filelock security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-22701: filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock impl…

  • Medium max 8.9
    ALAS2023-2026-1412 3 CVEs

    Moderate: python3.13-pip security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-66471: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly comp…

  • Medium max 9.1
    ALAS2023-2026-1405 4 CVEs

    Moderate: oci-add-hooks security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate…

  • Medium max 5.9
    ALAS2023-2026-1396 2 CVEs

    Moderate: libxml2 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-0992: A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated …

  • Medium max 6.8
    ALAS2023-2026-1390 2 CVEs

    Moderate: libpng security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-22801: LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26…

  • Medium max 9.1
    ALAS2023-2026-1374 4 CVEs

    Moderate: containerd security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate…

  • Medium max 4.8
    ALAS2023-2026-1372 1 CVE

    Moderate: capstone security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-67873: Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback ca…

  • Medium max 3.7
    ALAS2023-2026-1371 1 CVE

    Moderate: aws-nitro-enclaves-cli security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-3416: openssl: rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`

  • Medium max 8.9
    ALAS2023-2026-1368 2 CVEs

    Moderate: python3.11-pip security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-66471: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly comp…

  • Medium max 8.9
    ALAS2023-2026-1367 2 CVEs

    Moderate: python3.12-pip security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-66471: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly comp…

  • Medium max 8.9
    ALAS2023-2026-1366 2 CVEs

    Moderate: python-pip security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-66471: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly comp…

  • Medium max 6.5
    ALAS2023-2026-1363 1 CVE

    Moderate: libheif security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68431: libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path trigger…

  • Medium max 5.3
    ALAS2023-2026-1361 3 CVEs

    Moderate: ImageMagick security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-69204: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function…

  • Medium max 5.5
    ALAS2-2026-3130 1 CVE

    Moderate: libtiff security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-3598: LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via…

  • Medium max 6.3
    ALAS2-2026-3128 1 CVE

    Moderate: python security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-12084: When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. …

  • Medium max 8.9
    ALAS2-2026-3127 3 CVEs

    Moderate: python3-urllib3 security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-66471: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compres…

  • Medium max 8.9
    ALAS2-2026-3126 2 CVEs

    Moderate: python-pip security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-66471: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compres…

  • Medium max 5.3
    ALAS2-2026-3123 4 CVEs

    Moderate: ImageMagick security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-69204: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, u…

  • Medium max 6.3
    ALAS2023-2025-1356 3 CVEs

    Moderate: python3.11 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-13837: When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues C…

  • Medium max 8.2
    ALAS2023-2025-1355 3 CVEs

    Moderate: php8.1 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-14180: In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL dr…

  • Medium max 8.2
    ALAS2023-2025-1354 3 CVEs

    Moderate: php8.2 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-14180: In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL dr…

  • Medium max 8.2
    ALAS2023-2025-1353 3 CVEs

    Moderate: php8.3 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-14180: In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL dr…

  • Medium max 8.2
    ALAS2023-2025-1352 3 CVEs

    Moderate: php8.4 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-14180: In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL dr…

  • Medium max 7.5
    ALAS2023-2025-1351 5 CVEs

    Moderate: curl security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-9086: Out of bounds read for cookie path NOTE: https://curl.se/docs/CVE-2025-9086.html NOTE: Introduced with: https://github.com/curl/curl/commit/f24dc09d209a…

  • Medium max 5.9
    ALAS2023-2025-1348 1 CVE

    Moderate: nodejs24 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-62408: Use after free due to connection being cleaned up after error

  • Medium max 5.9
    ALAS2023-2025-1347 1 CVE

    Moderate: nodejs22 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-62408: Use after free due to connection being cleaned up after error

  • Medium max 5.9
    ALAS2023-2025-1346 1 CVE

    Moderate: nodejs20 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-62408: Use after free due to connection being cleaned up after error

  • Medium max 6.3
    ALAS2023-2025-1344 3 CVEs

    Moderate: python3.12 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-13837: When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues C…

  • Medium max 6.3
    ALAS2023-2025-1343 3 CVEs

    Moderate: python3.13 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-13837: When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues C…

  • Medium max 7.8
    ALAS2023-2025-1342 6 CVEs

    Moderate: grub2 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-61664: A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_e…