Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1950)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1950 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption CVE-2026-46331 Tenable has extracted the preceding description bloc...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1962)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1962 advisory. When using the tarfile module with a file opened in streaming mode mode=r| the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. CVE-2026-11972 Tenable has...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1987)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1987 advisory. In the Linux kernel, the following vulnerability has been resolved: locking/rtmutex: Skip removewaiter when waiter is not enqueued CVE-2026-53163 Tenable has extracted the preceding description block...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2026-1943)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1943 advisory. glamor Font Atlas Heap Buffer Overflow CVE-2026-55999 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for this...

Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1980)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1980 advisory. A use-after-free / double-free in c-ares' query-completion handling. Thesame flaw -- a query's callback being invoked while the query is stilllinked in the channel's internal lookup structures -- is...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2026-110 (ALASKERNEL-5.15-2026-110)

"The version of kernel installed on the remote host is prior to 5.15.210-148.245. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-110 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0...

Important: python3.14

Issue Overview: When using the "tarfile" module with a file opened in "streaming mode" mode="r|" the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. CVE-2026-11972 Affected Packages: python3.14 Issue Correction: Run dnf update python3.14 --releasever...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1964)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1964 advisory. The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result ...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1933)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1933 advisory. The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result ...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2026-1900)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1900 advisory. In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers...

Amazon Linux 2023 : opensc (ALAS2023-2026-1898)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1898 advisory. A flaw has been found in OpenSC up to 0.26.1. This affects the function testkpgencertwrite of the file src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation Module. This manipulation caus...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1925)

"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1925 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: skip ipv6 extension headers for csum checks CVE-2026-45850 In the Linux kernel, the following vulnerability has been...

Amazon Linux 2023 : cifs-utils, cifs-utils-devel, cifs-utils-info (ALAS2023-2026-1927)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1927 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks...

Amazon Linux 2023 : aws-nitro-tpm-tools (ALAS2023-2026-1905)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1905 advisory. A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate...

Amazon Linux 2023 : nerdctl (ALAS2023-2026-1908)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1908 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, . to execute repeatedly on the same...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-1909)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1909 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, . to execute repeatedly on the same...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2026-1899)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1899 advisory. If the certificate auto-enrollment GPO is enabled on domain membersboth in Samba's smb.conf and using Windows GPME tool, a CAcertificate may be fetched using a plain HTTP connection and installedin the...

Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-1922)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1922 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules. This vulnerability exists when the proxyhttpversion to 2 or grpcpass directives...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1929)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1929 advisory. tarfile.extractall with the 'data' or 'tar'filter could be bypassed by a crafted archive where a hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction...

Amazon Linux 2023 : gstreamer1-plugin-openh264, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-devel (ALAS2023-2026-1917)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1917 advisory. A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gstav1parserparsetilelistobu function passes a byte count to a bit-reader API that expects a...