ALAS2023-2026-2130

Amazon Linux 2023 Security Advisory: ALAS2023-2026-2130
Advisory Released Date: 2026-09-10
Advisory Updated Date: 2026-09-14

Severity: Important

References:
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

An HTTP/2 denial of service vulnerability was found in nginx. Prior to the fix, there was no limit on the number of request headers a client could send. An attacker could seed the HPACK dynamic table with a header, then emit thousands of indexed references that each cost significant server allocation. Combined with HTTP/2 zero-byte flow-control window stalling, all allocations are pinned indefinitely, allowing a single client to exhaust server memory.

Affected Packages:

nginx

Issue Correction:
Run dnf update nginx --releasever 2023.12.20260909 or dnf update --advisory ALAS2023-2026-2130 --releasever 2023.12.20260909 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    nginx-mod-http-xslt-filter-debuginfo-1.30.0-1.amzn2023.0.1.aarch64
    nginx-core-debuginfo-1.30.0-1.amzn2023.0.1.aarch64
    nginx-mod-http-perl-debuginfo-1.30.0-1.amzn2023.0.1.aarch64
    nginx-mod-stream-1.30.0-1.amzn2023.0.1.aarch64
    nginx-mod-stream-debuginfo-1.30.0-1.amzn2023.0.1.aarch64
    nginx-mod-http-image-filter-debuginfo-1.30.0-1.amzn2023.0.1.aarch64
    nginx-mod-http-perl-1.30.0-1.amzn2023.0.1.aarch64
    nginx-mod-mail-debuginfo-1.30.0-1.amzn2023.0.1.aarch64
    nginx-mod-http-xslt-filter-1.30.0-1.amzn2023.0.1.aarch64
    nginx-mod-devel-1.30.0-1.amzn2023.0.1.aarch64
    nginx-debugsource-1.30.0-1.amzn2023.0.1.aarch64
    nginx-debuginfo-1.30.0-1.amzn2023.0.1.aarch64
    nginx-1.30.0-1.amzn2023.0.1.aarch64
    nginx-mod-mail-1.30.0-1.amzn2023.0.1.aarch64
    nginx-mod-http-image-filter-1.30.0-1.amzn2023.0.1.aarch64
    nginx-core-1.30.0-1.amzn2023.0.1.aarch64

noarch:
    nginx-filesystem-1.30.0-1.amzn2023.0.1.noarch
    nginx-all-modules-1.30.0-1.amzn2023.0.1.noarch

src:
    nginx-1.30.0-1.amzn2023.0.1.src

x86_64:
    nginx-mod-mail-debuginfo-1.30.0-1.amzn2023.0.1.x86_64
    nginx-mod-stream-1.30.0-1.amzn2023.0.1.x86_64
    nginx-mod-http-perl-debuginfo-1.30.0-1.amzn2023.0.1.x86_64
    nginx-mod-stream-debuginfo-1.30.0-1.amzn2023.0.1.x86_64
    nginx-mod-devel-1.30.0-1.amzn2023.0.1.x86_64
    nginx-mod-http-xslt-filter-1.30.0-1.amzn2023.0.1.x86_64
    nginx-core-debuginfo-1.30.0-1.amzn2023.0.1.x86_64
    nginx-mod-http-perl-1.30.0-1.amzn2023.0.1.x86_64
    nginx-mod-mail-1.30.0-1.amzn2023.0.1.x86_64
    nginx-debuginfo-1.30.0-1.amzn2023.0.1.x86_64
    nginx-core-1.30.0-1.amzn2023.0.1.x86_64
    nginx-mod-http-image-filter-debuginfo-1.30.0-1.amzn2023.0.1.x86_64
    nginx-mod-http-xslt-filter-debuginfo-1.30.0-1.amzn2023.0.1.x86_64
    nginx-1.30.0-1.amzn2023.0.1.x86_64
    nginx-mod-http-image-filter-1.30.0-1.amzn2023.0.1.x86_64
    nginx-debugsource-1.30.0-1.amzn2023.0.1.x86_64

Additional References

Release Notes: Amazon Linux 2023 Release Notes

Red Hat:

Mitre: