Amazon Linux 2023

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: Amazon Linux 2023 📖 ~4 min read  •  Source: Amazon Linux advisory ALAS2023-2026-1618 Related CVEs: CVE-2026-0672 CVE-2026-3644 CVE-2026-4519 CVE-2026-4786 CVE-2026-6100 CVE-2025-11468 CVE-2025-15282 CVE-2026-0865  +12 more Upstream summary: The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: Amazon Linux 2023 📖 ~4 min read  •  Source: Amazon Linux advisory ALAS2023-2026-1626 Related CVEs: CVE-2026-33999 CVE-2026-34000 CVE-2026-34001 CVE-2026-34002 CVE-2026-34003 CVE-2025-62229 CVE-2025-62230 CVE-2025-62231  +7 more Upstream summary: XKB Integer Underflow in XkbSetCompatMap() (CVE-2026-33999) XKB Out-of-bounds Read in CheckSetGeom() (CVE-2026-34000) XSYNC Use-after-free in […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: Amazon Linux 2023 📖 ~4 min read  •  Source: Amazon Linux advisory ALAS2023-2026-1614 Related CVEs: CVE-2026-33999 CVE-2026-34000 CVE-2026-34001 CVE-2026-34002 CVE-2026-34003 CVE-2025-62229 CVE-2025-62230 CVE-2025-62231  +12 more Upstream summary: XKB Integer Underflow in XkbSetCompatMap() (CVE-2026-33999) XKB Out-of-bounds Read in CheckSetGeom() (CVE-2026-34000) XSYNC Use-after-free in […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: Amazon Linux 2023 📖 ~4 min read  •  Source: Amazon Linux advisory ALAS2023-2026-1613 Related CVEs: CVE-2026-33999 CVE-2026-34000 CVE-2026-34001 CVE-2026-34002 CVE-2026-34003 CVE-2025-62229 CVE-2025-62230 CVE-2025-62231  +12 more Upstream summary: XKB Integer Underflow in XkbSetCompatMap() (CVE-2026-33999) XKB Out-of-bounds Read in CheckSetGeom() (CVE-2026-34000) XSYNC Use-after-free in […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: Amazon Linux 2023 📖 ~4 min read  •  Source: Amazon Linux advisory ALAS2023-2026-1572 Related CVEs: CVE-2026-25679 CVE-2026-27139 CVE-2026-27142 CVE-2026-33186 CVE-2025-47914 CVE-2025-58181 CVE-2025-61727 CVE-2025-61729  +12 more Upstream summary: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. (CVE-2026-25679) On Unix platforms, […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: Amazon Linux 2023 📖 ~4 min read  •  Source: Amazon Linux advisory ALAS2023-2026-1564 Related CVEs: CVE-2026-25727 CVE-2026-3336 CVE-2026-3337 CVE-2026-3338 CVE-2026-4428 CVE-2022-24713 CVE-2025-3416 CVE-2022-46174 Upstream summary: time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: Amazon Linux 2023 📖 ~4 min read  •  Source: Amazon Linux advisory ALAS2023-2026-1560 Related CVEs: CVE-2026-35091 CVE-2026-35092 Upstream summary: A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: Amazon Linux 2023 📖 ~4 min read  •  Source: Amazon Linux advisory ALAS2023-2026-1551 Related CVEs: CVE-2026-33186 CVE-2026-27143 CVE-2026-27144 CVE-2026-32280 CVE-2026-32281 CVE-2026-32282 CVE-2026-32283 CVE-2026-32288  +4 more Upstream summary: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: Amazon Linux 2023 📖 ~4 min read  •  Source: Amazon Linux advisory ALAS2023-2026-1570 Related CVEs: CVE-2026-27856 CVE-2026-27857 CVE-2026-27858 CVE-2024-23184 CVE-2024-23185 Upstream summary: Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: Amazon Linux 2023 📖 ~4 min read  •  Source: Amazon Linux advisory ALAS2023-2026-1552 Related CVEs: CVE-2026-25679 CVE-2026-27139 CVE-2026-27142 CVE-2026-33186 CVE-2025-65637 CVE-2025-47912 CVE-2025-58183 CVE-2025-58185  +12 more Upstream summary: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. (CVE-2026-25679) On Unix platforms, […]