AWS Security BulletinsCVE-2026-10740

CVE-2026-10740 - Excessive memory allocation in s2n-quic

Bulletin ID: 2026-041-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/10/2026 10:45 AM PDT Description: AWS CDK (aws-cdk-lib) is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. We identified CVE-2026-11417, an OS command injection issue in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) that may allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the actor to control the value of one or more of the affected bundling properties in the CDK application. Impacted versions: < 2.245.0 (on Windows, < 2.246.0) Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Read the vendor bulletin

Not listedCVSS not listedNot listed severity

Scope

What the vendor says is affected

The collected bulletin did not provide a separate affected-products list. Check the original bulletin before making an exposure decision.

Update history

What changed in later vendor updates

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

Sep 9, 2026 at 9:30 PM UTC
- The vendor changed the advisory's last-updated date.

Timeline

When this advisory changed

Aug 20, 2026 at 9:50 PM UTC
Added to SecurityAlert
We collected the advisory from the official source.
Sep 9, 2026 at 9:15 PM UTC
Published by AWS
The publication date reported by the vendor.
Sep 9, 2026 at 9:30 PM UTC
Confirmed at the source
Our collector saw this advisory during a later source check.

Vulnerabilities

CVEs named in this advisory

CVE-2026-10740View CVSS, KEV, EPSS, and threat context CVE-2026-11417View CVSS, KEV, EPSS, and threat context

Source

Start with the vendor's bulletin

SecurityAlert organizes the fields the vendor published. The original bulletin remains the source of record for affected versions, fixes, and later changes.

Vendor: AWS
Advisory ID: CVE-2026-10740
Last source check: Sep 13, 2026 at 5:30 AM UTC

Open the official bulletin How SecurityAlert builds this record

Your environment

Check the systems you actually run

A vendor advisory can tell you what may be affected. It cannot tell you whether that product and version are installed in your environment.

Confirm the product and installed version.
Read the vendor's prerequisites and exceptions.
Test the update or mitigation through your normal change process.

Keep following

Get new AWS advisories

Use the vendor-specific RSS feed or set up alerts for a product your team relies on.

Follow this vendor's RSS feed

What the vendor says is affected

What changed in later vendor updates

When this advisory changed

CVEs named in this advisory

Related advisories from AWS

CVE-2026-89332 - Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration

CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2

CVE-2026-18061 - XML External Entity (XXE) in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

CVE-2026-89065 and CVE-2026-89066: Issue with projen - Path traversal and OS command injection

CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library