Amazon Linux 2027 Preview Security Advisory: ALAS2027-2026-194
Advisory Released Date: 2026-10-12
Advisory Updated Date: 2026-11-02
Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-94422:
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages.
xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.
A malicious or compromised Flatpak app could achieve arbitrary code execution outside its sandbox.
If other app frameworks rely on xdg-dbus-proxy in the same way that Flatpak does, then they will have an equivalent vulnerability until xdg-dbus-proxy is updated.
Affected Packages:
xdg-dbus-proxy
Issue Correction:
Run dnf update xdg-dbus-proxy --releasever 2027.0.20261012 or dnf update --advisory ALAS2027-2026-194 --releasever 2027.0.20261012 to update your system.
aarch64:
xdg-dbus-proxy-debugsource-0.1.9-1.amzn2027.0.1.aarch64
xdg-dbus-proxy-0.1.9-1.amzn2027.0.1.aarch64
xdg-dbus-proxy-debuginfo-0.1.9-1.amzn2027.0.1.aarch64
src:
xdg-dbus-proxy-0.1.9-1.amzn2027.0.1.src
x86_64:
xdg-dbus-proxy-debugsource-0.1.9-1.amzn2027.0.1.x86_64
xdg-dbus-proxy-debuginfo-0.1.9-1.amzn2027.0.1.x86_64
xdg-dbus-proxy-0.1.9-1.amzn2027.0.1.x86_64