Description
Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leading to arbitrary code execution on a client application that processes crafted event-stream messages.
To remediate this issue, users should upgrade to version 0.6.0 or later.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AWS | aws-c-event-stream | < 0.6.0 | 0.6.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | aws-c-event-stream | 0.7.0-1.1 | openSUSE-SU-2026:10512-1 |
| openSUSE Leap 16.0 | aws-c-event-stream | 0.4.2-bp160.2.1 | openSUSE-SU-2026:20477-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-awscrt | 0.36.4-1.amzn2023.0.2 | ALAS2023-2026-3280 |
Advisories 3
- ALAS2023-2026-3280 Important: python-awscrt security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 28, 2026
- openSUSE-SU-2026:20477-1 Security update for aws-c-event-stream SUSE / openSUSE Security Updates · Apr 10, 2026
- openSUSE-SU-2026:10512-1 aws-c-event-stream-devel-0.7.0-1.1 on GA media SUSE / openSUSE Security Updates · Apr 10, 2026