Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-4045
Advisory Released Date: 2026-10-28
Advisory Updated Date: 2026-11-09
The system certificate authority (CA) store in Amazon Linux, distributed via the ca-certificates RPM package, included multiple root CA certificates belonging to authorities that signed eMudhra intermediate CA certificates with weak private keys.
The root CA certificates that signed the weak intermediates were removed under CVE-2026-113470, which is the primary fix for this exposure: https://explore.alas.aws.amazon.com/CVE-2026-113470.html. Systems with that update installed no longer trust the weak intermediate CA certificates.
CVE-2026-114406 additionally removes the remaining CA certificates that were associated with the same CA operators, and removing them ensures no residual trust in those operators remains in the system CA store (CVE-2026-114406)
Affected Packages:
ca-certificates
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update ca-certificates or yum update --advisory ALAS2-2026-4045 to update your system.
noarch:
ca-certificates-2025.2.76-1.amzn2.0.4.noarch
src:
ca-certificates-2025.2.76-1.amzn2.0.4.src