early signals AWS security bulletins infra

CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure

// AI summary

AWS is addressing CVE-2026-111497, a native Brotli decoder flaw allowing remote code execution or memory disclosure in services like AWS Lambda and AWS App Runner.

// from the source

Bulletin ID: 2026-155-AWS Publication Date: 10/28/2026 15:00 PM PDT Description: AWS is aware of CVE-2026-111497, an issue in the native Brotli decompression library that could allow a third party to run code or read process memory in an affected application. AWS Lambda, AWS Amplify, AWS App Runner, Amazon CloudWatch Synthetics, AWS CodeBuild, AWS Elastic Beanstalk, and AWS Elemental MediaLive are addressing this issue. Some services require customer action. For details, see the bulletin. Read t
Read at aws.amazon.com ↗ More from AWS security bulletins

# more from AWS security bulletins

  1. AWS security bulletins infra

    CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes

    aws.amazon.com
  2. AWS security bulletins infra

    CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools

    aws.amazon.com
  3. AWS security bulletins infra

    CVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandas

    aws.amazon.com
  4. AWS security bulletins infra

    CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass

    aws.amazon.com
  5. AWS security bulletins infra

    CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)

    aws.amazon.com