CVE-2026-89161 (HIGH): detected in Lambda Docker Images.

Cerrado
  • ¿Algo no está bien?
#699 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
48/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
aws, docker
Área
cloud, devops, infrastructure, security

Línea de trabajo

No repository file or test is named. Start by locating how the listed Lambda Docker images are built and where the Amazon Linux package version is defined; verify the affected images use pcre2 10.40-1.amzn2023.0.4 and confirm the resulting image set no longer reports this CVE.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

CVE Details

CVE ID Severity Affected Package Installed Version Fixed Version Date Published Date of Scan
CVE-2026-89161 HIGH pcre2 10.40-1.amzn2023.0.3 10.40-1.amzn2023.0.4 2026-09-11T04:18:04.47Z 2026-09-30T10:18:15.665099892Z

Affected Docker Images

Image Name SHA
public.ecr.aws/lambda/provided:latest public.ecr.aws/lambda/provided@sha256:ffb064eaa67922bd2a7d5bd4f878cc964206565260b929bf00daa361f1dfaa2c
public.ecr.aws/lambda/provided:al2023 public.ecr.aws/lambda/provided@sha256:ffb064eaa67922bd2a7d5bd4f878cc964206565260b929bf00daa361f1dfaa2c
public.ecr.aws/lambda/python:latest public.ecr.aws/lambda/python@sha256:c89171d819ca635d366a456b8bcc220567a586a19fc64e5859f6cd429d896f8d
public.ecr.aws/lambda/python:3.15-preview public.ecr.aws/lambda/python@sha256:d100342954d5ec3c76d4ecf217454a5a914e193aeb1ccb84c5def04ded7a5c58
public.ecr.aws/lambda/python:3.14 public.ecr.aws/lambda/python@sha256:c89171d819ca635d366a456b8bcc220567a586a19fc64e5859f6cd429d896f8d
public.ecr.aws/lambda/python:3.13 public.ecr.aws/lambda/python@sha256:682b47c63e6f1efb1d6fca5ff89433d9ee77490e2ee688331f6a102ef5870ccc
public.ecr.aws/lambda/python:3.12 public.ecr.aws/lambda/python@sha256:a32fd0af1505dad402a3a8c2bc1766a81b292f6869f13f1239d6c28b57b434c7
public.ecr.aws/lambda/nodejs:latest public.ecr.aws/lambda/nodejs@sha256:523ce8499e16c3bff599c94691e1c6a1405aac415c13b95b98dbb9dddd052b77
public.ecr.aws/lambda/nodejs:26-preview public.ecr.aws/lambda/nodejs@sha256:f5118e838e4efe4462b87cb77b1b255170952560a5766ad9c0d3f30016c57800
public.ecr.aws/lambda/nodejs:24 public.ecr.aws/lambda/nodejs@sha256:523ce8499e16c3bff599c94691e1c6a1405aac415c13b95b98dbb9dddd052b77
public.ecr.aws/lambda/nodejs:22 public.ecr.aws/lambda/nodejs@sha256:282bd7028e6d1f365a3a174751634c7a84e12ef8a466cdcf786c3f4d744e743a
public.ecr.aws/lambda/java:latest public.ecr.aws/lambda/java@sha256:3967a35b70fd6d23b36423490d42be284fce0ebf9185cb5a7885b013a2a1f30f
public.ecr.aws/lambda/java:25 public.ecr.aws/lambda/java@sha256:3967a35b70fd6d23b36423490d42be284fce0ebf9185cb5a7885b013a2a1f30f
public.ecr.aws/lambda/java:21 public.ecr.aws/lambda/java@sha256:71f263451adcf72867ff07a20fbe0f9b31d1057f9fbe439d24fd79105284fe40
public.ecr.aws/lambda/dotnet:latest public.ecr.aws/lambda/dotnet@sha256:5e30337d617e3e2e893a19e08230298811da782275e2103e6c88faec12f8001c
public.ecr.aws/lambda/dotnet:10 public.ecr.aws/lambda/dotnet@sha256:5e30337d617e3e2e893a19e08230298811da782275e2103e6c88faec12f8001c
public.ecr.aws/lambda/dotnet:9 public.ecr.aws/lambda/dotnet@sha256:fa35156bcae41dbcde11dfba48f44de95a1a204b4eee403a6890b13c9b0af61f
public.ecr.aws/lambda/dotnet:8 public.ecr.aws/lambda/dotnet@sha256:9ae9a50f02d9c8b741bf45cfc558deea09e9a0b147252f5f1db9d3d5340829f1
public.ecr.aws/lambda/ruby:latest public.ecr.aws/lambda/ruby@sha256:d03542289586d83ab29c1efc6f7d01b2701d0672d1c7ce0e4d5aac6e561fce92
public.ecr.aws/lambda/ruby:4.0 public.ecr.aws/lambda/ruby@sha256:d03542289586d83ab29c1efc6f7d01b2701d0672d1c7ce0e4d5aac6e561fce92
public.ecr.aws/lambda/ruby:3.4 public.ecr.aws/lambda/ruby@sha256:cc17551ba0f3570c59d15835caf482dde68b5de6cf42236b4504bce97f37f95e
public.ecr.aws/lambda/ruby:3.3 public.ecr.aws/lambda/ruby@sha256:30fd99152591e9f678db8489c30e931970c1c81dcdaffda4dfe584cb81d3b1c8

Description

In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.

Remediation Steps
  • Update the affected package pcre2 from version 10.40-1.amzn2023.0.3 to 10.40-1.amzn2023.0.4.
About this issue
  • This issue may not contain all the information about the CVE nor the images it affects.
  • This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
  • For more, visit Lambda Watchdog.
  • This issue was created automatically by Lambda Watchdog.
Lenguaje dominante
Sin datos de lenguaje
Estrellas
775
Forks
117
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de aws/aws-lambda-base-images

Todos los issues de aws/aws-lambda-base-images

Issues similares

Más issues de Cloud

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.