Executive brief
A heap double-free vulnerability exists in AWS Common Runtime's aws-c-http library, which is a critical HTTP client library used by AWS SDKs and other applications that depend on AWS infrastructure. An attacker exploiting this memory corruption flaw could potentially cause application crashes, memory corruption, or arbitrary code execution, depending on heap state and exploitation technique.
Technical details
A heap double-free vulnerability exists in the aws-c-http library within AWS Common Runtime. The root cause is improper memory management where a heap-allocated object is freed multiple times, potentially triggered through malformed HTTP requests or specific protocol handling paths. The vulnerability can be exploited to corrupt heap metadata, bypass ASLR/other mitigations, or achieve arbitrary code execution. Attack preconditions depend on whether the library is exposed to untrusted network input; if used in a server context, remote exploitation is possible without authentication. AWS has published security guidance; patches are expected to be available through aws-c-http library updates and AWS SDK upgrades.
Affected products
- AWS aws-c-http <unknown>
Timeline
- 2026-09-22: disclosed