Amazon Web Services
CompanyFacts
- Country
- United StatesSource: Wikidata
- Founded
- 2006Source: Wikidata
- Sector
- Cloud computingSource: Wikidata
- Official website
- aws.amazon.comSource: Wikidata
Security timeline
- Vulnerability reported by AWS Security BulletinsAWS discloses credential exposure flaw in Kinesis Producer Library for Java (CVE-2026-119117)
- Vulnerability reported by AWS Security BulletinsAWS Nitro Enclaves SDK for C hit by use-after-free and KMS impersonation flaws
- Vulnerability reported by CSO OnlineCritical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
Recent news
AWS discloses credential exposure flaw in Kinesis Producer Library for Java (CVE-2026-119117)
AWS published CVE-2026-119117 affecting the Amazon Kinesis Producer Library for Java. When the logger is set to DEBUG, the AWS credentials the library resolved can be written to log files. Separately, affected versions pass the credentials to the native child process as command-line arguments, so a local user can read them from the process argument list. Versions before 1.0.8 are affected.
AWS Nitro Enclaves SDK for C hit by use-after-free and KMS impersonation flaws
AWS published bulletin 2026-157-AWS covering two issues in the AWS Nitro Enclaves SDK for C, affecting versions up to and including v0.4.5. CVE-2026-119116 is a use-after-free in the kmstool-enclave example application that lets an application on the parent EC2 instance send crafted vsock messages to run arbitrary code inside the enclave. CVE-2026-119148 is an input validation flaw in the SDK library that could let a third party impersonate KMS and inject forged responses.
Critical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
CVE-2026-111497, nicknamed Broccoli2Shell, is an out-of-bounds write in the Google Brotli decoder that can be exploited remotely without authentication. It can cause memory corruption, information disclosure, crashes or code execution. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October 2026. Software that bundles Brotli, including Node.js, .NET, PowerShell, Bun, Envoy Proxy, Istio and Python packages, may be affected.