Which versions of aws-c-http are affected by CVE-2026-12043?

A memory corruption flaw in the widely-used AWS Common Runtime aws-c-http library could allow attackers to inject code into client applications that connect to HTTP/2 servers.. A patch is available.

How to fix or mitigate CVE-2026-12043?

Within 24 hours: Identify all applications and services using aws-c-http library; prioritize those accepting HTTP/2 connections from external sources. Within 7 days: Apply AWS-released patch to test environments and validate application functionality. Within 30 days: Deploy patched version to all production systems and confirm all dependent applications have been redeployed.

aws-c-http CVE-2026-12043

Q: What is the CVSS score of CVE-2026-12043?

CVE-2026-12043 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36541 HIGH

Double Free (CWE-415)

2026-06-12 AMZN

RCE Buffer Overflow AWS Aws C Http

8.7

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable client-side flaw needing the victim to connect to a malicious HTTP/2 server (UI:R), heap grooming for RCE pushes AC:H; no auth required, full CIA impact on the client process.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 12, 2026 - 19:26 vuln.today

Analysis Generated

Jun 12, 2026 - 19:26 vuln.today

CVSS changed

Jun 12, 2026 - 19:22 NVD

8.8 (HIGH) 8.7 (HIGH)

DescriptionCVE.org

Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to cause memory corruption on a connecting client application, potentially leading to arbitrary code execution, via a crafted sequence of HTTP/2 HEADERS frames.

To remediate this issue, users should upgrade to aws-c-http version 0.11.0.

AnalysisAI

Client-side memory corruption in the AWS Common Runtime aws-c-http library can be triggered by a malicious HTTP/2 server that sends a crafted sequence of HEADERS frames manipulating the HPACK dynamic table size, potentially leading to arbitrary code execution in applications that use the library as an HTTP/2 client. The CVSS 4.0 score of 8.7 (High) reflects network reachability with low complexity but requires user/client interaction (initiating a connection to the attacker server). There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

aws-c-http is a C library in the AWS Common Runtime (CRT) family that implements HTTP/1.1 and HTTP/2 and is consumed by the AWS SDKs (C, C++, Python via awscrt, Java, Kotlin, etc.) and the AWS IoT Device SDK. HTTP/2 uses HPACK (RFC 7541) for header compression, which maintains a dynamic table whose size can be renegotiated at runtime via SETTINGS_HEADER_TABLE_SIZE and signaled inline in HEADERS frames using dynamic table size update instructions. The upstream fix (PR #559, 'Fix rounding error in hpack resizing') indicates an arithmetic edge case in the resize path of the HPACK decoder; combined with the CWE-415 (Double Free) classification, the most likely root cause is that a mishandled rounding boundary during table eviction causes the same dynamic-table entry buffer to be freed twice when the table is shrunk via attacker-controlled size updates.

RemediationAI

Vendor-released patch: aws-c-http 0.11.0 - upgrade directly via the GitHub release at https://github.com/awslabs/aws-c-http/releases/tag/v0.11.0, or rebuild/refresh any downstream AWS CRT-based SDK (aws-crt-python, aws-crt-java, aws-crt-cpp, AWS SDK for C++, AWS IoT Device SDK v2) once it ships a release that bundles aws-c-http >= 0.11.0, per the AWS bulletin at https://aws.amazon.com/security/security-bulletins/2026-043-aws/. Until the upgrade is rolled out, the most effective compensating control is to force HTTP/1.1 for outbound connections from aws-c-http clients (disable HTTP/2 / ALPN negotiation of h2), which fully avoids the HPACK code path at the cost of losing HTTP/2 multiplexing and header compression; alternatively, restrict outbound HTTP/2 to a vetted allow-list of trusted endpoints (e.g., known AWS service hostnames) via an egress proxy or firewall, which preserves performance but does not protect against compromise of those trusted endpoints. Generic network-layer controls do not mitigate this flaw because the malicious traffic rides inside legitimate TLS-wrapped HTTP/2.