ALAS2-2026-4101

References: CVE-2026-78661  CVE-2026-97045 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse. (CVE-2026-78661)

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text. (CVE-2026-97045)

Issue Correction:
Run yum update amazon-ssm-agent or yum update --advisory ALAS2-2026-4101 to update your system.

New Packages:

aarch64:
    amazon-ssm-agent-3.3.5828.0-1.amzn2.aarch64

src:
    amazon-ssm-agent-3.3.5828.0-1.amzn2.src

x86_64:
    amazon-ssm-agent-3.3.5828.0-1.amzn2.x86_64