AWS Security Bulletins
Printed in Security Desk · aws.amazon.com
Publishes about 12 a week · last piece Oct 16, 2026
How often
about 12 a week, by the archive: 43 pieces since Sep 22, 2026.
12 weeks agothis week
Latest pieces
- CVE-2026-18140 - Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
- CVE-2026-18394 - Incorrect authorization in Strands Agents Tools http_request tool
- Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react
- CVE-2026-16317 and CVE-2026-16318: Issues with s2n-tls: an open-source implementation of the TLS/SSL protocols
- CVE-2026-16756 - Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service
- Issue in the Linux kernel virtio-net/TAP networking path affecting KVM-based hypervisors
- CVE-2026-110812 - Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
- CVE-2026-110310 - RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET
- CVE-2026-15737 - Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK
- CVE-2026-15746 - Credential disclosure in Strands Agents Tools elasticsearch_memory tool
- CVE-2026-13760 - OS Command Injection in NodejsFunction Docker Bundling in aws-cdk-lib
- CVE-2026-12957 and CVE-2026-12958 - Issues in Language Servers for AWS and Amazon Q Developer Plugins
- CVE-2026-13769 – Insecure file permissions in AWS CLI
- Issue with containerd CRI Plugin - CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262
- CVE-2026-13762 and CVE-2026-13763 - Issue with HTTP/2 multi-frame request body inspection in AWS WAF
In these topics
Pick one in My Edition to read it with its neighbors.