ALAS2023-2026-1990

References: CVE-2026-11771  CVE-2026-12996  CVE-2026-13122 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

An attacker controlling an HTTP proxy (or performing MITM on the plaintext pre-TLS proxy connection) can trigger a single 0-byte overrun to a buffer on the stack by sending a crafted NTLM Type 2 challenge response. (CVE-2026-11771)

If the active TLS session has a pending dedicated ACK packet, tls_multi_process sets to_link to ks->ack_write_buf. If in the same execution of tls_multi_process, the initializing session reaches the authenticated stage, the active session will be freed which leaves to_link.data pointing to freed memory. (CVE-2026-12996)

openvpn Server crash on reception of suitably malformed auth-token, if --auth-gen-token external-auth is active (CVE-2026-13122)

Issue Correction:
Run dnf update openvpn --releasever 2023.12.20260720 or dnf update --advisory ALAS2023-2026-1990 --releasever 2023.12.20260720 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    openvpn-devel-2.6.12-1.amzn2023.0.5.aarch64
    openvpn-debuginfo-2.6.12-1.amzn2023.0.5.aarch64
    openvpn-2.6.12-1.amzn2023.0.5.aarch64
    openvpn-debugsource-2.6.12-1.amzn2023.0.5.aarch64

src:
    openvpn-2.6.12-1.amzn2023.0.5.src

x86_64:
    openvpn-debuginfo-2.6.12-1.amzn2023.0.5.x86_64
    openvpn-devel-2.6.12-1.amzn2023.0.5.x86_64
    openvpn-debugsource-2.6.12-1.amzn2023.0.5.x86_64
    openvpn-2.6.12-1.amzn2023.0.5.x86_64