CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel
CVE-2026-119086
Summary
Bulletin ID: 2026-159-AWS
Publication Date: 10/30/2026 11:00 AM PDT
Description:
We published CVE-2026-119117. Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application.
Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list.
Impacted versions:
- com.amazonaws:amazon-kinesis-producer <= 0.15.12
- oftware.amazon.kinesis:amazon-kinesis-producer < 1.0.8
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read this article
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.