Amazon Linux 2027 Preview Security Advisory: ALAS2027-2026-256
Advisory Released Date: 2026-10-27
Advisory Updated Date: 2026-11-02
Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-114406:
The system certificate authority (CA) store in Amazon Linux, distributed via the ca-certificates RPM package, included multiple root CA certificates belonging to authorities that signed eMudhra intermediate CA certificates with weak private keys.
The root CA certificates that signed the weak intermediates were removed under CVE-2026-113470, which is the primary fix for this exposure: https://explore.alas.aws.amazon.com/CVE-2026-113470.html. Systems with that update installed no longer trust the weak intermediate CA certificates.
CVE-2026-114406 additionally removes the remaining CA certificates that were associated with the same CA operators, and removing them ensures no residual trust in those operators remains in the system CA store.
Affected Packages:
ca-certificates
Issue Correction:
Run dnf update ca-certificates --releasever 2027.0.20261027 or dnf update --advisory ALAS2027-2026-256 --releasever 2027.0.20261027 to update your system.
noarch:
ca-certificates-2026.2.90_v9.0.316-101.0.amzn2027.noarch
src:
ca-certificates-2026.2.90_v9.0.316-101.0.amzn2027.src