AWSAWS-2026-039

AWS security bulletin

AWS

CVE-2026-11400 · Published Oct 19, 2026

High8.0

No fix yet

AWS advisory

CVE-2026-11400 and CVE-2026-11401

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SummaryOct 10Summary: Amazon Aurora PostgreSQL a fully managed relational database engine that's compatible with PostgreSQL. to CVE-2026-11400 and CVE-2026-11401

SeveritySep 26Severity: Unrated to High

Details and references

Severity from: NVD
Also known as: CVE-2026-11401

More AWS advisories

All AWS

High 7.5Oct 19

Allocation of resources without limits in the default aws-smithy-http-server serve() path...CVE-2026-16756no fix yet Medium 6.5Oct 19

Credential disclosure in Strands Agents Tools elasticsearch_memory toolCVE-2026-15746no fix yet Medium 6.5Oct 19

Issues with s2n-tls: an open-source implementation of the TLS/SSL protocolsCVE-2026-16317no fix yet Medium 5.7Oct 19

Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDKCVE-2026-15737no fix yet High 7.5Oct 19

Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows...CVE-2026-18140no fix yet High 7.8Oct 19

OS command injection in jsii-diff in AWS jsiiCVE-2026-15895no fix yet