CVE-2026-12043 - Heap double-free in AWS Common Runtime aws-c-http

The collected bulletin did not provide a separate affected-products list. Check the original bulletin before making an exposure decision.

We identified CVE-2026-12043, an issue where improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote actor operating a server to cause memory corruption on a connecting client application, potentially leading to arbitrary code execution, via a crafted sequence of HTTP/2 HEADERS frames.

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

1. Sep 9, 2026 at 9:30 PM UTC
   • The vendor changed the advisory's last-updated date.

1. Aug 20, 2026 at 9:50 PM UTC
   Added to SecurityAlert

   We collected the advisory from the official source.

2. Sep 9, 2026 at 9:15 PM UTC
   Published by AWS

   The publication date reported by the vendor.

3. Sep 9, 2026 at 9:30 PM UTC
   Confirmed at the source

   Our collector saw this advisory during a later source check.