Amazon Linux 2 : kernel (ALASKERNEL-5.4-2026-131)

The version of kernel installed on the remote host is prior to 5.4.302-229.498. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2026-131 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own...

Amazon Linux 2 : qemu (ALAS-2026-3934)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3934 advisory. NOTE: https://gitlab.com/qemu-project/qemu/-/workitems/4073NOTE: Fixed by: https://gitlab.com/qemu-...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-116)

The version of kernel installed on the remote host is prior to 5.15.220-153.252. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-116 advisory. In the Linux kernel, the following vulnerability has been resolved: futex: Prevent lockup in requeue-PI...

Amazon Linux 2 : dovecot (ALAS-2026-3935)

The version of dovecot installed on the remote host is prior to 2.2.36-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3935 advisory. An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses...

Amazon Linux 2 : crash (ALAS-2026-3937)

The version of crash installed on the remote host is prior to 8.0.4-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3937 advisory. A flaw was found in GDB's STABS debug format parser. Thereadmemberfunctions function in gdb/stabsread.c contains a linkedlist removal...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-132)

The version of kernel installed on the remote host is prior to 5.10.268-266.1092. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-132 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible res...

Important: rclone

Issue Overview: The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback,...

Important: exiv2

Issue Overview: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server WebReady/Curl builds CVE-2026-68546 Affected Packages: exiv2 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2...

Important: freeipmi

Issue Overview: FreeIPMI before 1.6.19 has a stack-based buffer overflow in ipmiseloemfujitsugetselentrylongtext in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses. CVE-2026-85504 Affected Packages: freeipmi Note: This advisory is applicable to...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-115)

The version of kernel installed on the remote host is prior to 5.15.220-153.253. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.15-2026-115 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom CVE-2026-810...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-131)

The version of kernel installed on the remote host is prior to 5.10.268-266.1094. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-131 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header...

Amazon Linux 2 : kernel (ALAS-2026-3929)

The version of kernel installed on the remote host is prior to 4.14.355-284.746. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3929 advisory. In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardhead...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardheader CVE-2026-68121 In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow CVE-2026-74469 In the Linux kernel, t...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2026-130)

The version of kernel installed on the remote host is prior to 5.4.302-226.490. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2026-130 advisory. In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardheader CVE-2026-68121 In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow CVE-2026-74469 In the Linux kernel, t...

Critical: unbound

Issue Overview: In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the dige...

Critical: unbound

Issue Overview: In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the dige...

CVE-2023-32803

The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 AL2 does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists because of an incorrect fix for CVE-2022-23491...

PT-2026-91047

The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 AL2 does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists because of an incorrect fix for CVE-2022-23491...

Amazon Linux 2 : webkitgtk4 (ALAS-2026-3917)

The version of webkitgtk4 installed on the remote host is prior to 2.52.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3917 advisory. A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.1...