Vulnerabilities
AWS Addresses Dirty Frag and Other Kernel Vulnerabilities in Amazon Linux
Amazon Web Services has released security bulletins addressing multiple kernel flaws, including the high-severity Dirty Frag issue, in its Linux distributions.
AWS
Vulnerabilities
AWS Advises of Linux Kernel Local Privilege Escalation via ESP-in-TCP Flaw
Amazon Web Services issued a security bulletin regarding a local privilege escalation vulnerability in the Linux kernel involving ESP-in-TCP implementation.
Vulnerabilities
AWS Advises on FreeRTOS-Plus-TCP DHCPv6 Integer Underflow Vulnerability
Amazon Web Services published a security bulletin detailing CVE-2026-7424, an integer underflow flaw in the FreeRTOS-Plus-TCP stack’s DHCPv6 sub-option parser.
Vulnerabilities
AWS Updates Security Bulletin on Copy.fail Malware and Related Variants
Amazon Web Services has issued an ongoing advisory regarding the Copy.fail malware campaign, detailing detection methods and mitigation strategies for cloud customers.
Vulnerabilities
AWS Issues Security Bulletin for CVE-2026-31431
Amazon Web Services has published a new security bulletin addressing vulnerability CVE-2026-31431, providing initial guidance for customers.
Vulnerabilities
AWS Advises on FreeRTOS-Plus-TCP MAC Validation and ICMP Underflow Flaws
Amazon Web Services issued a security bulletin addressing two vulnerabilities in FreeRTOS-Plus-TCP that involve MAC address bypass and integer underflow.
Vulnerabilities
AWS Kiro IDE Vulnerability Allows Unauthorized Writes to Execution Paths
A flaw in the Kiro IDE permits insufficient file write restrictions, potentially leading to code execution risks for users of the development environment.
Vulnerabilities
AWS Issues Advisory for CVE-2026-11931 Insecure Permissions in Kiro IDE
An AWS security bulletin highlights a vulnerability in the Kiro IDE where insecure permissions on authentication token cache files could expose sensitive credentials.
Vulnerabilities
AWS Discloses Excessive Memory Allocation Flaw in s2n-quic Library
Amazon Web Services has published a security bulletin detailing a high-severity memory allocation issue within its open-source s2n-quic library.
Vulnerabilities
AWS Advises of Heap Double-Free Vulnerability in Common Runtime HTTP Component
Amazon Web Services disclosed CVE-2026-12043, a heap double-free flaw in its Common Runtime library that could impact services using aws-c-http.
Vulnerabilities
AWS Issues Advisory for OS Command Injection in CDK NodejsFunction Bundling
A high-severity vulnerability in the AWS CDK library allows attackers to execute arbitrary commands during Docker bundling of Node.js functions.
Vulnerabilities
AWS Issues Security Bulletins for Two Vulnerabilities in Amazon Q Developer Plugins
Amazon Web Services has published advisories for two issues in its Language Servers for AWS and Amazon Q Developer, affecting IDE integrations.
Vulnerabilities
AWS Addresses Insecure File Permissions Vulnerability in Command Line Interface
The cloud provider issued an advisory for CVE-2026-13769, citing insecure file permissions that could expose sensitive data in the AWS CLI.
Vulnerabilities
AWS Issues Security Bulletins for Five Critical Containerd CRI Plugin Vulnerabilities
Amazon Web Services has published advisories for five CVEs in the containerd CRI plugin, urging users to assess their exposure to potential container escapes.
Vulnerabilities
AWS Amplify API Authorization Flaw Allows Cross-User Data Access
A vulnerability in AWS Amplify API components lets authenticated users access records belonging to other users through crafted queries.
Vulnerabilities
Patched AWS Bedrock AgentCore Flaw Allowed Single Prompt Takeover
A vulnerability dubbed 'AgentCorruption' in AWS Bedrock AgentCore allowed attackers to compromise entire AI fleets with one prompt.
Vulnerabilities
AWS PowerShell Tool Exposes Cleartext Console Passwords in Logs
A flaw in AWS Tools for PowerShell before version 5.0.306 allows local users to recover IAM user passwords from log files and command output.
Vulnerabilities
AWS CDK Asset Bundling Vulnerability Allows Symlink Injection via Docker Files
A flaw in AWS CDK allows untrusted Docker files to insert symlinked files during asset bundling, affecting versions before 2.267.0.
Vulnerabilities
AWS warns of high-severity RCE in Redshift Python driver; no patch available for CVE-2026-8838 yet
A flaw in the amazon-redshift-python-driver allows attackers to execute arbitrary code remotely, prompting an urgent security bulletin from Amazon Web Services.
Vulnerabilities
AWS patches high-severity OS command injection flaw in databases-on-aws plugin
A remote unauthenticated attacker could execute arbitrary OS commands via a crafted database command in vulnerable plugin versions.
Vulnerabilities
AWS Fixes Heap Buffer Overflow in coreMQTT MQTT5 Property Parsing
Amazon Web Services has released a security bulletin for CVE-2026-8686, addressing a heap out-of-bounds read vulnerability in its coreMQTT library.
Vulnerabilities
AWS SageMaker Python SDK Has Model Artifact Integrity Flaws
Two CVEs in the Amazon SageMaker Python SDK allow bypassing model artifact integrity checks, posing risks to ML pipelines.
Vulnerabilities
AWS Fixes Insecure File Permissions for CodeCatalyst Tokens in VS Code Extension
The AWS Toolkit for Visual Studio Code cached bearer tokens with world-readable permissions, exposing credentials to local attackers.
Vulnerabilities
AWS Fixes Code Injection and SSRF Flaws in Bedrock AgentCore Toolkit
Amazon patches two vulnerabilities in its open-source Bedrock AgentCore Starter Toolkit that allowed arbitrary code execution and server-side request forgery.