Important: spice

Issue Overview: A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap...

Medium: alsa-lib

Issue Overview: alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state fil...

Important: oci-add-hooks

Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...

Important: amazon-ecr-credential-helper

Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...

Low: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: nitroenclaves: fix use-after-free on SLOTALLOC failure CVE-2026-98775 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference...

Important: perl-YAML

Issue Overview: YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY do...

Important: mariadb

Issue Overview: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the...

Medium: gstreamer1-plugins-good

Issue Overview: A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size o...

Medium: perl

Issue Overview: Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count i...

Important: aspell

Issue Overview: A flaw was found in Aspell. An attacker could achieve arbitrary code execution or cause a Denial of Service DoS by convincing a user to process a specially crafted dictionary file. This issue occurs due to an integer calculation error during buffer capacity checks in the read-only...

Important: ant

Issue Overview: The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the...

Important: tomcat

Issue Overview: Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The...

Important: tomcat-native

Issue Overview: Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions m...

Important: xorg-x11-server

Issue Overview: CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but does not NULL the pointer. When the error path continues, XkbClearDoodad is called during cleanup and frees the same pointer again, resulting in a double free. An authenticated X client can trigger this by sending a...

Important: libXtst

Issue Overview: An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients. CVE-2026-94286 Affected Packages: libXtst Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ sectio...

Important: python-tornado

Issue Overview: Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory...

Important: mod_security

Issue Overview: GHSA-5pww-8rfg-9crf: RFC 2231 filename parameter bypasses multipart filename rules CVE-2026-104269 Affected Packages: modsecurity Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras...

Medium: qemu

Issue Overview: NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1f24066fc88d33455ee54a20f29994d9e69997ba v11.1.0-rc3 NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/5fbd2fe1cc54259d045d00d4966aa2db1ba990d6 v11.0.4 CVE-2026-18054 NOTE:...

Important: edk2

Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...

Important: gfs2-utils

Issue Overview: A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca with an exponentially-derived size from the untrusted on-disk didepth field without bounds validation. A crafted GFS2 filesystem image with a large didepth value causes...

Low: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: nitroenclaves: fix use-after-free on SLOTALLOC failure CVE-2026-98775 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.4 Extra. Visit this page to learn more about Amazon...

Medium: nginx

Issue Overview: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when the...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition CVE-2023-53178 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.4 Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras...

Medium: gstreamer-plugins-good

Issue Overview: A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size o...

Important: lrzsz

Issue Overview: lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped...

Important: containerd

Issue Overview: containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage before container start, causing long ContainerCreating stalls and, at larger sizes, node/runti...

Medium: firefox

Issue Overview: Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if...

Important: java-1.8.0-amazon-corretto

Issue Overview: Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if...

Medium: ca-certificates

Issue Overview: Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if...

Important: java-11-amazon-corretto

Issue Overview: Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if...

Important: java-17-amazon-corretto

Issue Overview: Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if...

Important: bind

Issue Overview: Inbound-message resource exhaustion CWE-400 leading to denial of service. No configuration precondition; version applicability is the deciding factor. Affected versions: 9.11.0-9.18.50, 9.20.0-9.20.29, 9.21.0-9.21.26. CVE-2026-19630 Replaying GSS-TSIG signed UDP messages can resul...

Important: qemu

Issue Overview: hw/display/qxl: validate primary surface stride against width CVE-2026-16271 hw/usb/hcd-xhci: Set reentrancy guard in timer functions CVE-2026-17588 hw/display/vga: fix text-mode OOB write after a graphics surface switch CVE-2026-77913 io/channel-socket: do not treat a zero length...

Important: python3-tornado

Issue Overview: Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory...

Important: cifs-utils

Issue Overview: A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System CIFS share using a user-controlled credentials file, input values are not properly sanitized before being...

Important: tigervnc

Issue Overview: CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but does not NULL the pointer. When the error path continues, XkbClearDoodad is called during cleanup and frees the same pointer again, resulting in a double free. An authenticated X client can trigger this by sending a...

Important: python3

Issue Overview: ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in SSLObject, if the serverhostname argument isn't supplied then hostname verification would be silently skipped. This defect...

Important: wireshark

Issue Overview: SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-95389 Heap buffer overflow WRITE in CSN.1 dissector -- CSNRECURSIVEARRAY writes past destination array with no capacity check packet-csn1.c. CVE-2026-95393 The X11 dissector cache...

Medium: golang

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in foucreate CVE-2026-74496 In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit neededheadroom and neededtailroom from lowerdev CVE-2026-74743 In the Linux...

Important: cni-plugins

Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...

Important: ghostscript

Issue Overview: A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling o...

Important: php

Issue Overview: cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounde...

Important: docker

Issue Overview: The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. CVE-2026-171...

Important: docker

Issue Overview: The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. CVE-2026-171...

Important: soci-snapshotter

Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...

Important: nerdctl

Issue Overview: Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and te...

Important: amazon-ecr-credential-helper

Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...

Medium: docker

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

Medium: runc

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...