Skip to content
OpenAdvisories

Source

Amazon Linux Security Center (ALAS)

Source: https://alas.aws.amazon.com/

All Critical High Medium Low With exploited CVEs

4,948 results · Feed

  • High max 7.5
    ALAS2023-2026-3181 8 CVEs

    Important: rust-cargo-c security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-82255: gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-…

    first Oct 12, 2026
  • High max 7.8
    ALAS2023-2026-2147 3 CVEs

    Important: emacs security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-96269: GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the inter…

    first Sep 14, 2026
  • High max 7.8
    ALAS2023-2026-1951 4 CVEs

    Important: rust security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-82255: gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-…

    first Jul 20, 2026
  • Medium max 7.5
    ALAS2-2026-4068 1 CVE

    Moderate: libreswan security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-14957: In Libreswan before 5.3.2, when the operating system and Libreswan are running in FIPS mode and at least one CA certificate is loaded, a malformed X.509 c…

  • High max 9.1
    ALAS2-2026-4067 1 CVE

    Important: java-11-amazon-corretto security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported ver…

  • High max 9.1
    ALAS2-2026-4066 1 CVE

    Important: java-17-amazon-corretto security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported ver…

  • High max 9.8
    ALAS2-2026-4065 1 CVE

    Important: kernel security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-98432: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period

  • Medium max 6.8
    ALAS2-2026-4064 1 CVE

    Moderate: golist security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-111943: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 package…

  • Medium max 6.8
    ALAS2-2026-4063 1 CVE

    Moderate: amazon-ssm-agent security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-111943: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 package…

  • High max 7.5
    ALAS2-2026-4062 1 CVE

    Important: python-dns security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-114605: dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop…

  • High max 8.1
    ALAS2-2026-4061 1 CVE

    Important: ImageMagick security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-116149: A flaw was found in ImageMagick. A stack-based buffer overflow vulnerability exists in the handling of bzip2 compressed images, where stack memory can be…

  • High max 8.7
    ALAS2-2026-4060 1 CVE

    Important: qt5-qtbase security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-16762: An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, maki…

  • Medium max 5.5
    ALAS2-2026-4059 1 CVE

    Moderate: libxml2 security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-76781: A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catal…

  • Medium max 7.5
    ALAS2-2026-4058 1 CVE

    Moderate: tomcat-native security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-86243: Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affe…

  • High max 9.6
    ALAS2-2026-4057 72 CVEs

    Important: thunderbird security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-93990: Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attack…

  • Medium max 6.8
    ALAS2-2026-4056 1 CVE

    Moderate: golang-github-cpuguy83-go-md2man security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-111943: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 package…

  • Medium max 6.8
    ALAS2-2026-4055 1 CVE

    Moderate: rclone security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-111943: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 package…

  • Medium max 6.8
    ALAS2-2026-4054 1 CVE

    Moderate: cni-plugins security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-111943: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 package…

  • Medium max 6.8
    ALAS2-2026-4053 1 CVE

    Moderate: nerdctl security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-111943: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 package…

  • Medium max 5.5
    ALAS2-2026-4052 1 CVE

    Moderate: awscli security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-13769: Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restric…

  • Medium max 7.1
    ALAS2-2026-4051 2 CVEs

    Moderate: OpenEXR security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-61555: OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.…

  • Low max 6.5
    ALAS2-2026-4050 1 CVE

    Low: file-roller security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-78322: A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roll…

  • High max 9.1
    ALAS2-2026-4049 3 CVEs

    Important: amazon-cloudwatch-agent security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-78663: The HTTP/2 server could refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-…

  • High max 9.8
    ALAS2-2026-4048 6 CVEs

    Important: perl-Text-CSV_XS security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-110759: Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the i…

  • High max 9.5
    ALAS2-2026-4047 1 CVE

    Important: edk2 security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-97631: EDK2 contains a vulnerability in BIOS where a user may cause "Out-of-bounds Write", Classic Buffer Overflow, and "Incorrect Calculation of Buffer Size" by…

  • High max 7.8
    ALAS2-2026-4046 1 CVE

    Important: emacs security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-108976: GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed…

  • Medium max 6.8
    ALAS2-2026-4045 1 CVE

    Moderate: ca-certificates security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-114406: The system certificate authority (CA) store in Amazon Linux, distributed via the ca-certificates RPM package, included multiple root CA certificates belo…

  • High max 8.1
    ALAS2023-2026-3374 2 CVEs

    Important: dotnet9.0 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-70197: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-114148: Incorrect default permissions in ASP.NET C…

  • High max 9.1
    ALAS2023-2026-3373 1 CVE

    Important: java-1.8.0-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …

  • High max 9.1
    ALAS2023-2026-3372 1 CVE

    Important: java-11-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …

  • High max 9.1
    ALAS2023-2026-3371 1 CVE

    Important: java-17-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …

  • High max 9.1
    ALAS2023-2026-3370 1 CVE

    Important: java-21-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …

  • High max 9.1
    ALAS2023-2026-3369 1 CVE

    Important: java-25-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …

  • High max 9.1
    ALAS2023-2026-3368 1 CVE

    Important: java-27-amazon-corretto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-114820: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …

  • High max 9.2
    ALAS2023-2026-3367 25 CVEs 1 exploited

    Important: dotnet8.0 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-96960: Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-96959: Allocation of r…

  • High max 8.8
    ALAS2023-2026-3366 24 CVEs

    Important: dotnet10.0 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-96960: Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-96959: Allocation of r…

  • High max 9.8
    ALAS2023-2026-3365 1 CVE

    Important: kernel security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-98432: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period

  • Medium max 6.8
    ALAS2023-2026-3364 1 CVE

    Moderate: golang-github-burntsushi-toml security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-111943: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 pack…

  • Medium max 6.8
    ALAS2023-2026-3363 1 CVE

    Moderate: golang-github-burntsushi-toml-test security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-111943: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 pack…

  • Medium max 6.8
    ALAS2023-2026-3362 1 CVE

    Moderate: golang-github-cpuguy83-md2man security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-111943: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 pack…