CVE-2026-12043: AWS Common Runtime HTTP/2 HPACK Memory Corruption – High Severity RCE

Technical summary

CVE-2026-12043 involves improper handling of HPACK dynamic table size updates in aws-c-http. HPACK is the HTTP/2 header compression mechanism; the dynamic table stores previously transmitted headers for compression efficiency. When a server sends a dynamic table size update, the client must adjust its internal table state accordingly. The vulnerability allows a malicious server to send a specially crafted sequence of HTTP/2 HEADERS frames that triggers memory corruption during this update process, classified under CWE-415 (Double Free). The CVSS 3.1 score of 8.8 (HIGH severity) reflects the combination of network accessibility, low attack complexity, and the potential for high confidentiality, integrity, and availability impact.

Business impact

Applications linking aws-c-http are exposed to remote code execution risk if users connect to untrusted or compromised HTTP/2 servers. This is particularly critical for services that accept user-provided URLs or proxy connections, where an attacker could intercept or redirect traffic to a malicious endpoint. Exploitation requires user interaction (initiating the connection) but no authentication. Affected deployments could face data exfiltration, system compromise, or lateral movement within infrastructure. The impact varies by application context—web browsers, API clients, and proxy services face higher risk.

Affected systems

Any application or service built with AWS Common Runtime library aws-c-http is potentially affected. This includes AWS SDK clients, AWS Lambda custom runtimes using the C SDK, and third-party applications that depend on aws-c-http for HTTP/2 support. The exact scope of affected systems depends on library adoption; direct and transitive dependencies should be inventoried. No specific vendor product versions are enumerated in the advisory; affected parties should check their build manifests and dependency trees for aws-c-http inclusion.

Exploitability

Exploitation requires a remote attacker to control or compromise an HTTP/2 server and trick or redirect a user's client application into connecting to it. The attack surface is broad for any application accepting remote URLs, but contained for applications connecting only to known, trusted endpoints. No public exploit code or proof-of-concept details are currently disclosed. The attack is not listed in the KEV (Known Exploited Vulnerabilities) catalog, indicating no evidence of active, in-the-wild exploitation at the time of publication. Practical exploitation complexity is moderate—an attacker must craft valid HTTP/2 frames that trigger the specific double-free condition.

Remediation

Upgrade aws-c-http to version 0.11.0 or later. This requires rebuilding applications that statically link the library or updating shared library installations. For AWS SDK users, update to the latest SDK version for your language and runtime. Organizations using AWS Lambda should redeploy custom runtimes or update runtime layers that bundle aws-c-http. Verify the fix is included by checking library versions in built artifacts or container images. Testing in staging environments is recommended before production deployment.

Patch guidance

Obtain aws-c-http 0.11.0 from the AWS Common Runtime repository or your package manager (e.g., pip, npm, Maven Central, depending on language bindings). Rebuild static binaries or redeploy systems using shared libraries. For containerized deployments, update base images and rebuild containers. Coordinate patching across your supply chain—any internal tools or downstream packages that depend on aws-c-http should be updated in sequence. Verify the patched version is running by checking library version strings in application logs or debug output.

Detection guidance

Monitor for unexpected client connection terminations or crashes correlated with HTTP/2 traffic. Memory corruption often manifests as segmentation faults or heap corruption errors in application logs. Implement network-level monitoring to detect unusual HPACK dynamic table size updates or malformed HTTP/2 frames. If possible, enable debug logging in aws-c-http (via AWS_COMMON_LOG_LEVEL environment variable) to capture frame-level details. Correlate crashes with connection attempts to external or user-controlled servers. Endpoint detection tools may observe abnormal process termination patterns.

Why prioritize this

This vulnerability merits urgent attention due to its combination of remote exploitability, high CVSS score (8.8), and potential for arbitrary code execution. The lack of authentication requirements and the broad applicability across AWS SDK consumers increase organizational risk. Although not yet exploited in the wild, the technical barrier to exploitation is moderate and proof-of-concept development is feasible. Organizations using HTTP/2 clients for external connections should prioritize patching to prevent opportunistic compromise.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: Network vector (AV:N) due to remote exploitability; Low attack complexity (AC:L) as no special preconditions are needed beyond connecting to a malicious server; No privilege requirement (PR:N) or user interaction beyond initiating the connection (UI:R); Scope unchanged (S:U); and High impact across confidentiality, integrity, and availability (C:H/I:H/A:H) due to the potential for memory corruption and code execution. The score is elevated by the ease of delivery and severity of the potential outcome, though the need for user-initiated connection and lack of active exploitation provide some mitigation.

Frequently asked questions