Amazon Linux 2023 Security Advisory: ALAS2023-2026-3337
Advisory Released Date: 2026-10-29
Advisory Updated Date: 2026-11-09
The system certificate authority (CA) store in Amazon Linux, distributed via the ca-certificates RPM package, included multiple root CA certificates belonging to authorities that signed eMudhra intermediate CA certificates with weak private keys.
The root CA certificates that signed the weak intermediates were removed under CVE-2026-113470, which is the primary fix for this exposure: https://explore.alas.aws.amazon.com/CVE-2026-113470.html. Systems with that update installed no longer trust the weak intermediate CA certificates.
CVE-2026-114406 additionally removes the remaining CA certificates that were associated with the same CA operators, and removing them ensures no residual trust in those operators remains in the system CA store (CVE-2026-114406)
Affected Packages:
ca-certificates
Issue Correction:
Run dnf update ca-certificates --releasever 2023.12.20261028 or dnf update --advisory ALAS2023-2026-3337 --releasever 2023.12.20261028 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
noarch:
ca-certificates-2025.2.76-1.0.amzn2023.0.5.noarch
src:
ca-certificates-2025.2.76-1.0.amzn2023.0.5.src