Amazon Linux 2023 Security Advisory: ALAS2023-2026-2064
Advisory Released Date: 2026-08-17
Advisory Updated Date: 2026-08-17
FAQs regarding Amazon Linux ALAS/CVE Severity
libgit2 Submodule path traversal (CVE-2026-53584)
Unbounded Memory Allocation via Delta Object Result-Size Header (CVE-2026-53585)
libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in set_data() in src/libgit2/transports/smart_pkt.c.
The vulnerable code uses a fixed-size strncmp (smart_pkt.c:239) against the unvalidated capability buffer of a smart-protocol pkt-line. When the bytes following the pkt-line in the contiguous receive buffer happen to continue with "ct-format=", the comparison spuriously matches, advancing format_str past the pkt-line boundary. The following memchr(format_str, ' ', len - (format_str - line)) (smart_pkt.c:246) then underflows its size_t size argument to ~SIZE_MAX and walks the heap looking for a space byte. An unauthenticated remote attacker who controls (or man-in-the-middles) a Git server reached over HTTP/HTTPS/SSH/git:// can trigger this on the FIRST ref-pkt of the refs advertisement, before any capability negotiation has taken place. The OOB walk causes a process crash (SIGSEGV) when memchr enters an unmapped page, and -- on heap layouts where memchr finds a stray space byte before crashing -- can additionally drive the git_error_set("...'%.*s'", format_len, format_str) formatter to copy a large window of heap memory into the error string. (CVE-2026-53587)
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites. (CVE-2026-66032)
libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs. (CVE-2026-66033)
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region. (CVE-2026-66034)
libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication. (CVE-2026-66035)
Affected Packages:
rust-cargo-c
Issue Correction:
Run dnf update rust-cargo-c --releasever 2023.12.20260817 or dnf update --advisory ALAS2023-2026-2064 --releasever 2023.12.20260817 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
cargo-c-debuginfo-0.10.21-1.amzn2023.0.1.aarch64
cargo-c-0.10.21-1.amzn2023.0.1.aarch64
rust-cargo-c-debugsource-0.10.21-1.amzn2023.0.1.aarch64
src:
rust-cargo-c-0.10.21-1.amzn2023.0.1.src
x86_64:
cargo-c-debuginfo-0.10.21-1.amzn2023.0.1.x86_64
cargo-c-0.10.21-1.amzn2023.0.1.x86_64
rust-cargo-c-debugsource-0.10.21-1.amzn2023.0.1.x86_64