Source

Amazon Linux Security Center (ALAS)

Source: https://alas.aws.amazon.com/

All Critical High Medium Low With exploited CVEs

4,948 results · Feed

High max 7.5

ALAS2023-2026-1385 4 CVEs

Important: java-17-amazon-corretto security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-21945: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Support…

Feb 5, 2026
High max 7.5

ALAS2023-2026-1384 4 CVEs

Important: java-11-amazon-corretto security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-21945: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Support…

Feb 5, 2026
High max 8.1

ALAS2023-2026-1383 3 CVEs

Important: ImageMagick security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-23952: NULL pointer dereference in MSL (Magick Scripting Language) parser when processing <comment> tag before any image is loaded. CVE-2026-23876: ImageMagic…

Feb 5, 2026
High max 9.1

ALAS2023-2026-1381 6 CVEs

Important: golang security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate…

Feb 5, 2026
High max 7.8

ALAS2023-2026-1380 1 CVE

Important: gnupg2 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68973: In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for…

Feb 5, 2026
High max 7.7

ALAS2023-2026-1379 7 CVEs

Important: freerdp security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-23884: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to f…

Feb 5, 2026
High max 8.8

ALAS2023-2026-1378 3 CVEs

Important: fontforge security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-15279: FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute…

Feb 5, 2026
Medium max 9.1

ALAS2023-2026-1374 4 CVEs

Moderate: containerd security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate…

Feb 5, 2026
Medium max 4.8

ALAS2023-2026-1372 1 CVE

Moderate: capstone security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-67873: Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback ca…

Feb 5, 2026
Medium max 3.7

ALAS2023-2026-1371 1 CVE

Moderate: aws-nitro-enclaves-cli security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-3416: openssl: rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`

Feb 5, 2026
High

ALAS2023-2026-1369 1 CVE

Important: sox security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-50798: SoX 14.4.2 contains a division by zero vulnerability when handling WAV files that can cause program crashes. Attackers can trigger a floating point exc…

Jan 23, 2026
Medium max 8.9

ALAS2023-2026-1368 2 CVEs

Moderate: python3.11-pip security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-66471: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly comp…

Jan 23, 2026
Medium max 8.9

ALAS2023-2026-1367 2 CVEs

Moderate: python3.12-pip security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-66471: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly comp…

Jan 23, 2026
Medium max 8.9

ALAS2023-2026-1366 2 CVEs

Moderate: python-pip security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-66471: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly comp…

Jan 23, 2026
Low max 1.3

ALAS2023-2026-1365 1 CVE

Low: composer security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-67746: Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer d…

Jan 23, 2026
High max 7.8

ALAS2023-2026-1364 2 CVEs

Important: openexr security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-12839: Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote a…

Jan 23, 2026
Medium max 6.5

ALAS2023-2026-1363 1 CVE

Moderate: libheif security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68431: libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path trigger…

Jan 23, 2026
High max 9.8

ALAS2023-2026-1362 1 CVE

Important: net-snmp security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68615: net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd da…

Jan 23, 2026
Medium max 5.3

ALAS2023-2026-1361 3 CVEs

Moderate: ImageMagick security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-69204: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function…

Jan 23, 2026
Low max 3.3

ALAS2023-2026-1360 1 CVE

Low: libxml2 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-8732: A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of t…

Jan 23, 2026
Medium max 5.5

ALAS2-2026-3130 1 CVE

Moderate: libtiff security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-3598: LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via…

Jan 21, 2026
High

ALAS2-2026-3129 1 CVE

Important: sox security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-50798: SoX 14.4.2 contains a division by zero vulnerability when handling WAV files that can cause program crashes. Attackers can trigger a floating point except…

Jan 21, 2026
Medium max 6.3

ALAS2-2026-3128 1 CVE

Moderate: python security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-12084: When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. …

Jan 21, 2026
Medium max 8.9

ALAS2-2026-3127 3 CVEs

Moderate: python3-urllib3 security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-66471: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compres…

Jan 21, 2026
Medium max 8.9

ALAS2-2026-3126 2 CVEs

Moderate: python-pip security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-66471: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compres…

Jan 21, 2026
High max 7.8

ALAS2-2026-3125 1 CVE

Important: gnupg2 security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-68973: In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for cr…

Jan 21, 2026
High max 9.8

ALAS2-2026-3124 1 CVE

Important: net-snmp security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-68615: net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemo…

Jan 21, 2026
Medium max 5.3

ALAS2-2026-3123 4 CVEs

Moderate: ImageMagick security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-69204: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, u…

Jan 21, 2026
Low max 3.3

ALAS2-2026-3122 1 CVE

Low: libxml2 security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-8732: A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the …

Jan 21, 2026
High max 7.5

ALAS2023-2025-1359 15 CVEs

Important: amazon-ssm-agent security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-8556: A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-ord…

Jan 7, 2026
High max 7.5

ALAS2023-2025-1358 5 CVEs

Important: amazon-cloudwatch-agent security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68156: Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`…

Jan 7, 2026
High max 9.8

ALAS2023-2025-1357 12 CVEs

Important: ecs-service-connect-agent security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-66220: Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy's mTLS certificate matcher for match_typ…

Jan 7, 2026
Medium max 6.3

ALAS2023-2025-1356 3 CVEs

Moderate: python3.11 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-13837: When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues C…

Jan 7, 2026
Medium max 8.2

ALAS2023-2025-1355 3 CVEs

Moderate: php8.1 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-14180: In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL dr…

Jan 7, 2026
Medium max 8.2

ALAS2023-2025-1354 3 CVEs

Moderate: php8.2 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-14180: In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL dr…

Jan 7, 2026
Medium max 8.2

ALAS2023-2025-1353 3 CVEs

Moderate: php8.3 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-14180: In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL dr…

Jan 7, 2026
Medium max 8.2

ALAS2023-2025-1352 3 CVEs

Moderate: php8.4 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-14180: In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL dr…

Jan 7, 2026
Medium max 7.5

ALAS2023-2025-1351 5 CVEs

Moderate: curl security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-9086: Out of bounds read for cookie path NOTE: https://curl.se/docs/CVE-2025-9086.html NOTE: Introduced with: https://github.com/curl/curl/commit/f24dc09d209a…

Jan 7, 2026
High max 5.6

ALAS2023-2025-1349 1 CVE

Important: glib2 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-14087: Buffer underflow on Glib through glib/gvariant via bytestring_parse() or string_parse() leads to OOB Write.

Jan 7, 2026
Medium max 5.9

ALAS2023-2025-1348 1 CVE

Moderate: nodejs24 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-62408: Use after free due to connection being cleaned up after error

Jan 7, 2026