ALAS2023-2026-1421

Details

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate chain

CVE-2025-61730: crypto/tls: handshake messages may be processed at the incorrect encryption level

CVE-2025-61728: archive/zip: denial of service when parsing arbitrary ZIP archives

CVE-2025-61726: net/http: memory exhaustion in Request.ParseForm

Affected Packages

soci-snapshotter

AmazonLinux 2023

Fixed in:

0.12.0-1.amzn2023.0.3

References

ADVISORY

https://alas.aws.amazon.com/AL2023/ALAS2023-2026-1421.html