CVE-2026-12043: Heap Double-Free Vulnerability Discovered in AWS Common Runtime aws-c-http Library
A second-rack bagel that's nearly first-rack. Tasty stuff.
Summary
AWS disclosed CVE-2026-12043, a heap double-free vulnerability in the AWS Common Runtime aws-c-http library. The issue stems from improper handling of HPACK dynamic table size updates, which could allow a remote attacker to exploit the flaw. The HTTP client library is used by AWS SDKs for handling HTTP requests to AWS services. The bulletin is classified as Important (requires attention) and was published on June 12, 2026.
Key quotes
· 3 pulledWe identified CVE-2026-12043, an issue where improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote attacker to exploit the vulnerability.
AWS Common Runtime aws-c-http is a HTTP client library used by AWS SDKs for handling http requests to AWS services.
Content Type: Important (requires attention)
You might also wanna read
Proof-of-Concept Exploit Released for Critical NGINX Heap Buffer Overflow (CVE-2026-42945)
A proof-of-concept exploit for CVE-2026-42945, a critical heap buffer overflow vulnerability in NGINX's ngx_http_rewrite_module that has exi
github.com·1mo ago
Technical Analysis of CVE-2025-53149: Heap-based Buffer Overflow in Windows Kernel Streaming Driver
Researchers discovered CVE-2025-53149, a heap-based buffer overflow vulnerability in the Windows Kernel Streaming WOW Thunk Service Driver (
crowdfense.com·9mo ago
React2Shell Vulnerability: Critical RCE Bug in React Server Components Flight Protocol
The article discusses React2Shell (CVE-2025-55182), a critical remote code execution vulnerability in React Server Components' Flight protoc
elenacross7.medium.com·6mo ago
Researcher Discovers Critical React2Shell RCE Vulnerability (CVE-2025-55182) Affecting Millions of Websites
A security researcher recounts discovering a critical remote code execution vulnerability (CVE-2025-55182, dubbed "React2Shell") in the Reac
lachlan.nz·1mo ago
Critical Redis Vulnerability (CVE-2025-49844) Allows Remote Code Execution with Maximum CVSS Score
Wiz Research has discovered a critical remote code execution vulnerability (CVE-2025-49844, nicknamed #RediShell) in Redis, the widely used
wiz.io·8mo ago
Critical Security Vulnerability CVE-2025-66478 in React Server Components Protocol
A critical security vulnerability (CVE-2025-66478) has been discovered in the React Server Components (RSC) protocol with a CVSS score of 10
nextjs.org·6mo ago