ecs-service-connect-agent: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-73553: Fixed an...

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-73553: Fixed an authorization bypass when ignore_path_parameters_in_path_matching was enabled, where a path such as /admin;x could bypass an RBAC policy for /admin while still reaching the protected route. CVE-2026-73552: Fixed an issue where safe_regex matching treated accepted non-UTF-8 HTTP header bytes as a non-match; in RBAC policies using negative matching this could fail open and allow access to a protected resource. CVE-2026-73551: Fixed URL normalization of dot and dot-dot path segments containing parameters, which could cause access-control components and upstream applications to interpret a request path differently. CVE-2026-73550: Fixed an HTTP/2 memory-exhaustion issue where discarded duplicate Host headers were not counted toward request-header size and count limits. CVE-2026-73549: Fixed an abnormal process termination for scoped IPv6 client addresses in original DST clusters with HTTP/3. CVE-2026-73548: Fixed cross-user response poisoning involving generic, non-WebSocket HTTP upgrades, where request payload sent before an upgrade was accepted could contaminate a shared upstream connection. CVE-2026-73547: Fixed an abnormal process termination in the ext_authz filter when processing CONNECT requests without a :path pseudo-header. CVE-2026-73546: Fixed a stored cross-site scripting issue in the HTML stats interface (/stats?format=html) where dynamically named statistics could introduce attacker-controlled content. CVE-2026-73513: Fixed a heap use-after-free where an untrusted upstream could send HTTP/2 response trailers without the END_STREAM flag to an Envoy instance using oghttp2, corrupting stream state and terminating the process. CVE-2026-73512: Fixed a use-after-free in the QUIC HTTP datagram handler where late HTTP/3 datagrams could reference a stream decoder that was already destroyed or replaced. CVE-2026-73511: Fixed path matching for paths containing per-segment parameters, where Envoy and backends could select different resources for the same request and bypass path-based selection or authentication. CVE-2026-50572: Fixed a use-after-free in the ext_authz raw HTTP client where completing an authorization request could destroy the client while its completion handler was still executing. CVE-2026-48521: An Envoy proxy handling HTTP/3 connections can dereference a null transport socket option during the selection of a connection pool. This null pointer dereference is a CWE-476 flaw that may cause the process to crash or terminate unexpectedly, leading to a denial of service for the services routed through the affected Envoy instance. The vulnerability is triggered when a client initiates an HTTP/3 session that exercises the connection-pool selection logic, which may provide the attacker a remote execution path to disrupt the proxy.

Where it's fixed