Amazon Web Services CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Amazon Web Services CVE published 2026-06-23

CVE-2026-12957

CVE-2026-12957 is a high-severity vulnerability in Language Servers for AWS before version 1.65.0. The issue involves improper trust boundary enforcement, which may allow for arbitrary code execution if a local user opens a maliciously crafted workspace. This requires the user to trust the workspace when prompted. The vulnerability has a CVSS score of 8.5 and is considered HIGH severity. To remediate this [truncated]

MEDIUM Amazon Web Services CVE published 2026-06-10

CVE-2026-10740

CVE-2026-10740 is a medium-severity vulnerability in s2n-quic, a QUIC implementation. The vulnerability is caused by unbounded memory allocation in the CRYPTO frame reassembler, which may allow an unauthenticated remote actor to cause a denial of service (degraded availability) by sending crafted QUIC Initial packets.