CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java
CVE-2026-119117
Summary
Bulletin ID: 2026-157-AWS
Publication Date: 10/30/2026 09:00 AM PDT
Description:
We identified CVE-2026-119116, a use-after-free in the SetClient command handler of the kmstool-enclave example application, where an application that executes on the parent EC2 instance could send crafted messages over vsock to corrupt heap memory inside the enclave and execute arbitrary code within it. Only enclave images that include kmstool-enclave, or code derived from it, are affected.
We also identified CVE-2026-119148, an input validation issue in the SDK library where the AWS KMS server name is built from a caller-supplied region string. A third party could supply a crafted region to impersonate KMS to the enclave and inject forged responses, such as actor-chosen key material.
Impacted versions: aws-nitro-enclaves-sdk-c <= v0.4.5 (CVE-2026-119116 affects kmstool-enclave only; CVE-2026-119148 affects the library)
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read this article
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 2
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.