ALAS2027-2026-272

References: CVE-2026-111943  CVE-2026-78667  CVE-2026-78659 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-78667:
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) could consume an excessive amount of CPU.

These functions now ignore Range headers containing more than 200 ranges.
The limit is controlled by the new httpservecontentmaxranges=GODEBUG setting. Setting GODEBUG=httpservecontentmaxranges=0 disables the limit.

NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81858
NOTE: Fixed by: https://github.com/golang/go/commit/ababc3cd873d8acce1777268aa7a817e6b672028 (go1.27.2)
NOTE: Fixed by: https://github.com/golang/go/commit/eb25b4e532c5a01f99ef860ec66743a8783f992b (go1.26.9)

CVE-2026-78659:
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits.
This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.
Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits are now applied towards the trailer fields declared in "Trailer" headers.

NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81857
NOTE: Fixed by: https://github.com/golang/go/commit/cbb0fb8b51cba866018b8a0fb4b5458f16c5c80b (go1.27.2)
NOTE: Fixed by: https://github.com/golang/go/commit/6e049521882c944afc1e519a83971ec421dc2974 (go1.26.9)

CVE-2026-111943:
Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse of certificate issued by the affected intermediate certificates.

Amazon Linux golang-based packages are being rebuilt with the fixed crypto/x509 package described in CVE-2026-111943 as a defense-in-depth measure against the eMudhra intermediate CA certificates with weak private keys.

By default, Go programs on Amazon Linux use the system-wide certificate authority (CA) store. Therefore, the primary fix for this issue is the ca-certificates update that removes the root CA certificates that signed the affected intermediates. Customers should ensure that update is installed: https://explore.alas.aws.amazon.com/CVE-2026-113470.html

Issue Correction:
Run dnf update cni-plugins --releasever 2027.0.20261102 or dnf update --advisory ALAS2027-2026-272 --releasever 2027.0.20261102 to update your system.

New Packages:

aarch64:
    cni-plugins-1.7.1-1.amzn2027.0.8.aarch64
    cni-plugins-debuginfo-1.7.1-1.amzn2027.0.8.aarch64
    cni-plugins-debugsource-1.7.1-1.amzn2027.0.8.aarch64

src:
    cni-plugins-1.7.1-1.amzn2027.0.8.src

x86_64:
    cni-plugins-1.7.1-1.amzn2027.0.8.x86_64
    cni-plugins-debuginfo-1.7.1-1.amzn2027.0.8.x86_64
    cni-plugins-debugsource-1.7.1-1.amzn2027.0.8.x86_64