Threats affecting pkg:github/aws/aws-sdk-cpp

CVE-2026-19643 is an out-of-bounds read vulnerability in the Base64 decoder of the AWS aws-sdk-cpp library before version 1.11.862. This flaw can cause a remote authenticated user to crash an application processing crafted Base64-encoded input. The issue affects some platforms and results in denial of service due to application crashes. AWS has released version 1.11.862 to remediate this vulnerability.

CVE-2026-19642 is an out-of-bounds write vulnerability in the Base64 decoder of the AWS aws-sdk-cpp library before version 1.11.862. This flaw could allow a remote authenticated user to cause a crash or heap memory corruption by processing specially crafted Base64-encoded input. The issue affects versions up to and including 1.11.861. AWS has released version 1.11.862 to address this vulnerability.

Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgrade AWS SDK for C++ to version 1.11.712 or later