Amazon Linux 2023 : cargo-c (ALAS2023-2026-2113)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2113 advisory. libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend USESSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on a...

Amazon Linux 2 : freerdp (ALAS-2026-3887)

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3887 advisory. FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the...

Amazon Linux 2023 : python3.12-pip, python3.12-pip-wheel (ALAS2023-2026-2091)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2091 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions...

Amazon Linux 2023 : postgresql16, postgresql16-contrib, postgresql16-llvmjit (ALAS2023-2026-2078)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2078 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via craft...

Amazon Linux 2 : microcode_ctl, --advisory ALAS2-2026-3872 (ALAS-2026-3872)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3872 advisory. Improper handling of overlap between protected memory ranges for some IntelR XeonR 6 processors when using IntelR TDX...

Amazon Linux 2 : mrtg, --advisory ALAS2-2026-3884 (ALAS-2026-3884)

The version of mrtg installed on the remote host is prior to 2.17.4-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3884 advisory. A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged...

Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2026-028 (ALASTOMCAT9-2026-028)

The version of tomcat installed on the remote host is prior to 9.0.121-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2026-028 advisory. Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat:...

Amazon Linux 2023 : libgit2, libgit2-devel (ALAS2023-2026-2083)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2083 advisory. libgit2 Inverted IP SubjectAltName Comparison in OpenSSL Backend vuln111 CVE-2026-53583 libgit2 Submodule path traversal CVE-2026-53584 Unbounded Memory Allocation via Delta Object Result-Size...

Amazon Linux 2 : thunderbird, --advisory ALAS2-2026-3880 (ALAS-2026-3880)

The version of thunderbird installed on the remote host is prior to 140.14.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3880 advisory. Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the...

Amazon Linux 2 : samba, --advisory ALAS2-2026-3886 (ALAS-2026-3886)

The version of samba installed on the remote host is prior to 4.10.16-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3886 advisory. A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory...

Amazon Linux 2023 : iperf3, iperf3-devel (ALAS2023-2026-2070)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2070 advisory. A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control- channel JSON with oversized numeric parameters, such as parallel and len, which are not properly...

Amazon Linux 2 : postgresql, --advisory ALAS2POSTGRESQL14-2026-025 (ALASPOSTGRESQL14-2026-025)

The version of postgresql installed on the remote host is prior to 14.24-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL14-2026-025 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database us...

Amazon Linux 2 : containerd, --advisory ALAS2ECS-2026-135 (ALASECS-2026-135)

The version of containerd installed on the remote host is prior to 2.1.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2026-135 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable has extracte...

Amazon Linux 2 : gimp, --advisory ALAS2GIMP-2026-019 (ALASGIMP-2026-019)

The version of gimp installed on the remote host is prior to 2.8.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GIMP-2026-019 advisory. A flaw was found in GIMP. A signed integer overflow vulnerability exists in the file-fli plugin when processing FLI image...

Important: dracut

Issue Overview: A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent...

Medium: python3.14-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

Medium: gd

Issue Overview: NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24 DEBIANBUG: 1143152 CVE-2026-9672 Affected Packages: gd Issue Correction: Run dnf update gd --releasever 2023.12.20260831 or dnf update --advisory ALAS2023-2026-2103 --releasev...

Important: iperf3

Issue Overview: A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.15 Extra. Visit this page to learn more about...