ALAS2023-2026-1951

References: CVE-2026-40034  CVE-2026-82252  CVE-2026-82254  CVE-2026-82255 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution. (CVE-2026-40034)

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external files as submodule configuration and expose attacker-controlled name, path, and url values. (CVE-2026-82252)

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills. (CVE-2026-82254)

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP downgrades. (CVE-2026-82255)

Issue Correction:
Run dnf update rust --releasever 2023.12.20260720 or dnf update --advisory ALAS2023-2026-1951 --releasever 2023.12.20260720 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    rust-debuginfo-1.97.0-1.amzn2023.0.1.aarch64
    clippy-1.97.0-1.amzn2023.0.1.aarch64
    clippy-debuginfo-1.97.0-1.amzn2023.0.1.aarch64
    rust-analyzer-debuginfo-1.97.0-1.amzn2023.0.1.aarch64
    rustfmt-debuginfo-1.97.0-1.amzn2023.0.1.aarch64
    rust-std-static-1.97.0-1.amzn2023.0.1.aarch64
    rustfmt-1.97.0-1.amzn2023.0.1.aarch64
    rust-1.97.0-1.amzn2023.0.1.aarch64
    cargo-debuginfo-1.97.0-1.amzn2023.0.1.aarch64
    rust-analyzer-1.97.0-1.amzn2023.0.1.aarch64
    cargo-1.97.0-1.amzn2023.0.1.aarch64
    rust-debugsource-1.97.0-1.amzn2023.0.1.aarch64
    rust-doc-1.97.0-1.amzn2023.0.1.aarch64

noarch:
    rust-std-static-wasm32-unknown-unknown-1.97.0-1.amzn2023.0.1.noarch
    rust-gdb-1.97.0-1.amzn2023.0.1.noarch
    rust-debugger-common-1.97.0-1.amzn2023.0.1.noarch
    rust-toolset-srpm-macros-1.97.0-1.amzn2023.0.1.noarch
    rust-lldb-1.97.0-1.amzn2023.0.1.noarch
    rust-toolset-1.97.0-1.amzn2023.0.1.noarch
    rust-std-static-wasm32-wasip1-1.97.0-1.amzn2023.0.1.noarch
    rust-src-1.97.0-1.amzn2023.0.1.noarch

src:
    rust-1.97.0-1.amzn2023.0.1.src

x86_64:
    cargo-debuginfo-1.97.0-1.amzn2023.0.1.x86_64
    rust-debuginfo-1.97.0-1.amzn2023.0.1.x86_64
    rustfmt-debuginfo-1.97.0-1.amzn2023.0.1.x86_64
    rust-analyzer-debuginfo-1.97.0-1.amzn2023.0.1.x86_64
    clippy-debuginfo-1.97.0-1.amzn2023.0.1.x86_64
    rust-std-static-1.97.0-1.amzn2023.0.1.x86_64
    rust-1.97.0-1.amzn2023.0.1.x86_64
    clippy-1.97.0-1.amzn2023.0.1.x86_64
    rustfmt-1.97.0-1.amzn2023.0.1.x86_64
    rust-analyzer-1.97.0-1.amzn2023.0.1.x86_64
    cargo-1.97.0-1.amzn2023.0.1.x86_64
    rust-debugsource-1.97.0-1.amzn2023.0.1.x86_64
    rust-doc-1.97.0-1.amzn2023.0.1.x86_64

Changelog:

2026-11-02: CVE-2026-82254 was added to this advisory.

2026-11-02: CVE-2026-82252 was added to this advisory.

2026-11-02: CVE-2026-82255 was added to this advisory.