CVE-2026-12043: AWS Common Runtime aws-c-http RCE Flaw

CVE-2026-12043 Overview

CVE-2026-12043 is a memory corruption vulnerability in the AWS Common Runtime aws-c-http library. The flaw stems from improper handling of HPACK dynamic table size updates during HTTP/2 HEADERS frame processing. A remote threat actor operating a malicious server can deliver a crafted sequence of HTTP/2 HEADERS frames to a connecting client. The resulting memory corruption may lead to arbitrary code execution within the client application. The issue is classified under [CWE-415] (Double Free) and affects client applications that link against vulnerable versions of aws-c-http. AWS published the fix in aws-c-http version 0.11.0.

Critical Impact
A malicious HTTP/2 server can corrupt client memory and potentially execute arbitrary code inside any application built on the affected AWS Common Runtime HTTP library.

Affected Products

AWS Common Runtime aws-c-http library prior to version 0.11.0
Applications and SDKs that embed aws-c-http for HTTP/2 client connectivity
AWS SDKs and tooling distributing pre-0.11.0 aws-c-http builds

Discovery Timeline

2026-06-12 - CVE-2026-12043 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12043

Vulnerability Analysis

The vulnerability resides in the HPACK decoder logic inside aws-c-http. HPACK is the header compression format defined by RFC 7541 and used in HTTP/2. It maintains a dynamic table of header field entries that both peers must keep synchronized. The protocol allows either peer to emit a dynamic table size update, which forces eviction of existing entries when the table shrinks.

The aws-c-http implementation mishandles the lifecycle of entries during these size updates when they are interleaved within a sequence of HEADERS frames. The condition aligns with [CWE-415] Double Free, indicating that the same allocation can be released more than once during HPACK state transitions. Freeing a buffer twice corrupts the allocator's metadata and produces an exploitable primitive for attacker-controlled writes.

Because the bug is reachable purely through inbound HTTP/2 protocol data, any client that completes a TLS handshake to a hostile server can trigger the condition. Successful exploitation may pivot from memory corruption to arbitrary code execution in the client process.

Root Cause

The root cause is incorrect ownership tracking of HPACK dynamic table entries when a size update triggers eviction during header block decoding. Entries referenced by the in-progress decode are freed by the eviction path and again by the decoder cleanup path, producing a double free.

Attack Vector

Exploitation requires a victim client to initiate an HTTP/2 connection to a server controlled by the attacker. User interaction is limited to the act of connecting, for example by following a URL or triggering an outbound API call. The attacker server replies with a crafted sequence of HEADERS frames containing malicious dynamic table size updates that trip the double free in the client.

No verified public exploit code is available. Technical details are described in the GitHub Security Advisory GHSA-rmjr-3qpm-vh98 and the AWS Security Bulletin 2026-043.

Detection Methods for CVE-2026-12043

Indicators of Compromise

Client process crashes or allocator abort messages such as double free or corruption originating from threads running aws-c-http HPACK decode routines.
Unexpected outbound HTTP/2 connections from applications to untrusted hosts, followed by abnormal process termination or child process creation.
Core dumps showing corrupted heap metadata with stack frames inside aws-c-http HPACK functions.

Detection Strategies

Inventory binaries and containers for linked versions of aws-c-http below 0.11.0, including AWS SDK distributions that bundle the library.
Inspect HTTP/2 traffic at the TLS-terminating proxy for sequences of HEADERS frames containing repeated or unusually small dynamic table size updates.
Correlate process crash telemetry with preceding outbound HTTP/2 sessions to identify candidate exploitation attempts.

Monitoring Recommendations

Enable crash and exception telemetry on hosts running AWS SDK-based clients and forward to a central analytics platform.
Alert on new outbound HTTP/2 destinations from server-side workloads that normally talk only to known AWS endpoints.
Track software bill of materials updates so that any redeployment of a service reusing the old aws-c-http version is flagged for remediation.

How to Mitigate CVE-2026-12043

Immediate Actions Required

Upgrade aws-c-http to version 0.11.0 or later across all applications, containers, and build pipelines.
Rebuild and redeploy AWS SDKs and downstream binaries that statically link aws-c-http.
Restrict outbound HTTP/2 traffic from sensitive workloads to an allowlist of trusted endpoints until patching completes.

Patch Information

AWS released the fix in aws-c-http0.11.0. Refer to the GitHub Release v0.11.0 notes and the AWS Security Bulletin 2026-043 for guidance on dependent SDK versions and rebuild requirements.

Workarounds

Force HTTP/1.1 in client configurations where the API supports protocol selection, preventing HPACK decode paths from being reached.
Route outbound HTTPS traffic through an egress proxy that terminates HTTP/2 and re-emits requests, isolating client processes from attacker-controlled frame sequences.
Constrain affected services with seccomp or AppArmor profiles that block execve and unexpected network egress to reduce the impact of memory corruption.

bash

# Verify the linked aws-c-http version inside a build or container
ldd ./my-aws-client | grep aws-c-http
strings $(ldd ./my-aws-client | awk '/aws-c-http/ {print $3}') | grep -i 'aws-c-http '

# Update via vcpkg
vcpkg update && vcpkg upgrade aws-c-http

# Or pin in CMake to the fixed release tag
# FetchContent_Declare(aws-c-http GIT_TAG v0.11.0)