# CVE-2026-12043: AWS aws-c-http memory corruption in HPACK resizing

Source: https://junglewise.ai/threats/cve-2026-12043-aws-aws-c-http-memory-corruption-in-hpack-resizing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-12043 · Severity: high · CVSS 8.8 · Published 2026-06-12

A heap double-free vulnerability exists in AWS Common Runtime's aws-c-http library, which is a critical HTTP client library used by AWS SDKs and other applications that depend on AWS infrastructure. An attacker exploiting this memory corruption flaw could potentially cause application crashes, memory corruption, or arbitrary code execution, depending on heap state and exploitation technique.

Technologies: [Amazon AWS](https://junglewise.ai/threats/technologies/aws). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon), [Amazon Web Services](https://junglewise.ai/threats/vendors/amazon-web-services).

## Quick answers

**Is CVE-2026-12043 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12043 being exploited in the wild.

**How severe is CVE-2026-12043?** High severity, with a CVSS score of 8.8, published 12 June 2026.

**Which products and versions are affected?** Amazon Web Services Aws-C-Http <unknown>, >= 0.4.22, <= 0.10.15; Amazon Web Services SDK for Java v2 >= 2.44.27, <= 2.44.14.

**Is there a fix for CVE-2026-12043?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12043 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-12043?** Check whether you run Amazon AWS, Amazon Web Services Aws-C-Http or Amazon Web Services SDK for Java v2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap double-free vulnerability exists in the aws-c-http library within AWS Common Runtime. The root cause is improper memory management where a heap-allocated object is freed multiple times, potentially triggered through malformed HTTP requests or specific protocol handling paths. The vulnerability can be exploited to corrupt heap metadata, bypass ASLR/other mitigations, or achieve arbitrary code execution. Attack preconditions depend on whether the library is exposed to untrusted network input; if used in a server context, remote exploitation is possible without authentication. AWS has published security guidance; patches are expected to be available through aws-c-http library updates and AWS SDK upgrades.

## Affected products

- AWS aws-c-http <unknown>

## Timeline

- 2026-09-22: disclosed

## References

- [https://aws.amazon.com/security/security-bulletins/rss/2026-043-aws/](https://aws.amazon.com/security/security-bulletins/rss/2026-043-aws/)

## Related threats

- [An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0)](https://junglewise.ai/threats/cve-2026-126793-privilege-escalation-in-aurora-postgresql-dialect-detection-in)
- [AWS SDK for pandas EMR unverified bucket ownership](https://junglewise.ai/threats/cve-2026-127119-unverified-ownership-of-the-default-emr-cluster-log-location-in)
- [Amazon mcp-gateway-registry server-side request forgery in registration API](https://junglewise.ai/threats/cve-2026-125926-server-side-request-forgery-in-the-server-registration-and)
- [Amazon mcp-gateway-registry authorization bypass in management API](https://junglewise.ai/threats/cve-2026-100307-missing-authorization-on-the-external-management-api-in-mcp)
- [AWS Kiro CLI incorrect default permissions on session files](https://junglewise.ai/threats/cve-2026-124848-incorrect-default-permissions-on-session-transcripts-and-prompt)