CVE-2026-12043: Heap double-free in AWS Common Runtime aws-c-http

Synopsis

A heap double-free vulnerability exists in the AWS Common Runtime aws-c-http library, affecting versions up to and including 0.10.15. The flaw is reachable over the network without authentication, but requires a user or client application to connect to a server controlled by the attacker; a crafted sequence of HTTP/2 HEADERS frames triggers improper HPACK dynamic table size update handling, corrupting heap memory on the connecting client. Successful exploitation gives the attacker arbitrary code execution on the client host. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must operate a reachable server that the victim client connects to over the network; the vulnerable code path is triggered during an HTTP/2 session initiated by the client.

• AuthenticationNot required

  No credentials or account are needed; the attacker only needs to serve a crafted HTTP/2 response to any connecting client.

• Victim interactionRequired

  A user or automated process must initiate a connection to the attacker-controlled server, making this a social-engineering or supply-chain-redirect vector.

• Attack complexityDetail

  The exploit is reliable and imposes no race-condition or environmental precondition beyond the client initiating an HTTP/2 connection.

Blast Radius

• Arbitrary code executes in the context of the client application process that called into aws-c-http.
• An attacker with code execution can read any data the client process holds in memory, including in-flight credentials, tokens, and response payloads.
• The attacker can modify data the process writes, enabling tampering with outbound requests or local state.
• The client process crashes or is fully taken over, disrupting any service that depends on it.