Amazon Linux 2027 Preview Security Advisory: ALAS2027-2026-113
Advisory Release Date: 2026-10-12 09:00 Pacific
Advisory Updated Date: 2026-10-12 09:00 Pacific
libgit2 Submodule path traversal (CVE-2026-53584)
libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in set_data() in src/libgit2/transports/smart_pkt.c.
The vulnerable code uses a fixed-size strncmp (smart_pkt.c:239) against the unvalidated capability buffer of a smart-protocol pkt-line. When the bytes following the pkt-line in the contiguous receive buffer happen to continue with "ct-format=", the comparison spuriously matches, advancing format_str past the pkt-line boundary. The following memchr(format_str, ' ', len - (format_str - line)) (smart_pkt.c:246) then underflows its size_t size argument to ~SIZE_MAX and walks the heap looking for a space byte. An unauthenticated remote attacker who controls (or man-in-the-middles) a Git server reached over HTTP/HTTPS/SSH/git:// can trigger this on the FIRST ref-pkt of the refs advertisement, before any capability negotiation has taken place. The OOB walk causes a process crash (SIGSEGV) when memchr enters an unmapped page, and -- on heap layouts where memchr finds a stray space byte before crashing -- can additionally drive the git_error_set("...'%.*s'", format_len, format_str) formatter to copy a large window of heap memory into the error string. (CVE-2026-53587)
Affected Packages:
network-flow-monitor-agent
Issue Correction:
Run yum update network-flow-monitor-agent to update your system.
aarch64:
network-flow-monitor-agent-debuginfo-1.1.8-1.amzn2027.0.5.aarch64
network-flow-monitor-agent-1.1.8-1.amzn2027.0.5.aarch64
network-flow-monitor-agent-debugsource-1.1.8-1.amzn2027.0.5.aarch64
src:
network-flow-monitor-agent-1.1.8-1.amzn2027.0.5.src
x86_64:
network-flow-monitor-agent-debuginfo-1.1.8-1.amzn2027.0.5.x86_64
network-flow-monitor-agent-1.1.8-1.amzn2027.0.5.x86_64
network-flow-monitor-agent-debugsource-1.1.8-1.amzn2027.0.5.x86_64