Skip to content
OpenAdvisories

Source

Amazon Linux Security Center (ALAS)

Source: https://alas.aws.amazon.com/

All Critical High Medium Low With exploited CVEs

4,948 results · Feed

  • High max 9.8
    ALAS2023-2026-3402 166 CVEs

    Important: kernel6.12 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-99098: In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size CVE-2026-99085…

  • High max 7.5
    ALAS2023-2026-3401 4 CVEs

    Important: rclone security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-78659: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server…

  • High max 10.0
    ALAS2023-2026-3400 4 CVEs 1 exploited

    Important: ruby4.0 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-97229: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under c…

  • Medium max 7.5
    ALAS2023-2026-3399 1 CVE

    Moderate: perl-podlators security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-82560: Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output …

  • High max 7.8
    ALAS2023-2026-3398 3 CVEs

    Important: rpm security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-95519: A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manif…

  • High max 8.4
    ALAS2023-2026-3397 1 CVE

    Important: gstreamer1-plugins-base security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-86476: A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declar…

  • High max 6.3
    ALAS2023-2026-3396 1 CVE

    Important: glibc security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-86805: A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a l…

  • High max 7.5
    ALAS2023-2026-3395 1 CVE

    Important: runfinch-finch security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-93450: go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion wi…

  • High max 7.5
    ALAS2023-2026-3394 9 CVEs

    Important: libXi security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-94282: Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion. CVE-2026-94281: An out-of-bounds read in libXi's XListInputDevices() class parsi…

  • High max 7.5
    ALAS2023-2026-3393 1 CVE

    Important: gnome-remote-desktop security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-96541: A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshak…

  • High max 7.8
    ALAS2023-2026-3392 1 CVE

    Important: librsvg2 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-96889: A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-aft…

  • High max 7.5
    ALAS2023-2026-3391 3 CVEs

    Important: docker security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-97045: In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, …

  • High max 9.8
    ALAS2023-2026-3390 8 CVEs

    Important: kernel6.18 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-98788: In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize CVE-2026-98715: In the Linux kerne…

  • High max 9.8
    ALAS2023-2026-3389 14 CVEs

    Important: kernel security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-99082: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache CVE-2026-99053: In the Li…

  • High max 7.5
    ALAS2023-2026-3388 1 CVE

    Important: haproxy security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-110354: A flaw was found in haproxy. A remote, unauthenticated attacker can trigger a denial of service (DoS) by sending a specially crafted HTTP/1.1 chunked …

  • High max 9.8
    ALAS2023-2026-3387 1 CVE

    Important: jackson-databind security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-110879: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplet…

  • High max 7.5
    ALAS2023-2026-3386 2 CVEs

    Important: python-mistune security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-115352: Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU b…

  • High max 8.7
    ALAS2023-2026-3385 3 CVEs

    Important: python-twisted security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-115778: A flaw was found in Twisted. The Telnet service implementation fails to enforce a size limit on incoming data buffers during protocol option negotiati…

  • High max 8.8
    ALAS2023-2026-3384 2 CVEs

    Important: xdg-desktop-portal security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-55889: XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles me…

  • High max 7.5
    ALAS2023-2026-3383 1 CVE

    Important: jackson-core security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-68498: StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume whi…

  • Medium max 7.5
    ALAS2023-2026-3382 2 CVEs

    Moderate: rust security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-82249: gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing ba…

  • Medium max 7.5
    ALAS2023-2026-3381 1 CVE

    Moderate: rust-cargo-c security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-82247: gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority compone…

  • Medium max 6.5
    ALAS2023-2026-3380 1 CVE

    Moderate: rust security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-82250: gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet…

  • Medium max 3.5
    ALAS2023-2026-3379 1 CVE

    Moderate: polkit security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-85498: A flaw was found in polkit. A regression in the fix for CVE-2026-4897 introduced a stack buffer underflow (out-of-bounds read) in the read_cookie() fun…

  • High max 7.5
    ALAS2023-2026-3378 5 CVEs

    Important: amazon-efs-utils security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-93601: rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtre…

  • Medium max 7.5
    ALAS2023-2026-3377 1 CVE

    Moderate: libreswan security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-14957: In Libreswan before 5.3.2, when the operating system and Libreswan are running in FIPS mode and at least one CA certificate is loaded, a malformed X.50…

  • Medium max 5.5
    ALAS2023-2026-3376 1 CVE

    Moderate: lvm2 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-19617: A flaw was found in libdm. A remote attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures.…

  • High max 7.5
    ALAS2023-2026-3375 3 CVEs

    Important: aws-workload-credentials-provider security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-93601: rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtre…

  • High max 9.1
    ALAS2023-2026-3320 46 CVEs

    Important: java-25-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.…

    first Oct 26, 2026
  • High max 9.1
    ALAS2023-2026-3319 46 CVEs

    Important: java-21-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.…

    first Oct 26, 2026
  • High max 9.1
    ALAS2023-2026-3318 46 CVEs

    Important: java-17-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.…

    first Oct 26, 2026
  • High max 9.1
    ALAS2023-2026-3317 46 CVEs

    Important: java-11-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.…

    first Oct 26, 2026
  • High max 9.1
    ALAS2023-2026-3316 43 CVEs

    Important: java-27-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.…

    first Oct 26, 2026
  • High max 9.1
    ALAS2023-2026-3315 46 CVEs

    Important: java-1.8.0-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.…

    first Oct 26, 2026
  • High max 9.1
    ALAS2-2026-4040 46 CVEs

    Important: java-17-amazon-corretto security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.…

    first Oct 26, 2026
  • High max 9.1
    ALAS2-2026-4039 46 CVEs

    Important: java-11-amazon-corretto security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-91487: Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.…

    first Oct 26, 2026
  • High max 7.8
    ALAS2-2026-3808 5 CVEs

    Important: rust security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-82255: gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-con…

    first Jul 20, 2026
  • High max 9.8
    ALAS2023-2026-3335 272 CVEs

    Important: kernel6.12 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-99088: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in set_ipv6_addr CVE-2026-9908…

  • Medium max 9.1
    ALAS2023-2026-3324 5 CVEs

    Moderate: docker security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-97030: A trusted template author may have previously written a valid template wherein the use of the |yield| keyword would not be correctly escaped. We now en…

    first Oct 26, 2026
  • High max 7.6
    ALAS2023-2026-3266 11 CVEs

    Important: docker security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-94440: Parsing a multipart form could bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part was l…

    first Oct 26, 2026