CVE-2026-12043 - Heap double-free in AWS Common Runtime aws-c-http
Common Runtime ยท 2026-10-19
Actions
Technical Details
| Affected Versions | aws-c-http >= 0.4.22 AND <= 0.10.15, aws-sdk-cpp >= 1.11.41, <= 1.11.814, aws-sdk-java-v2 >= 2.44.27, <= 2.44.14 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-12043 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update the aws-c-http library to version 0.11.0 and ensure all dependent SDKs (aws-sdk-cpp and aws-sdk-java-v2) are upgraded to compatible versions to address the heap double-free vulnerability (CVE-2026-12043).
For Platform Teams
Integrate the updated aws-c-http library (version 0.11.0) into the platform to enhance security and prevent potential memory corruption issues in client applications.
For Executives
Implement the security patch for aws-c-http to mitigate the risk of memory corruption and arbitrary code execution, ensuring the integrity and security of client applications connecting to AWS services.