Bulletin ID: 2026-150-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/24/2026 20:00 PM PDT
Last Updated Date: 11/11/2026 12:05 PM PST

Summary:

AWS-owned TLS trust bundles are certificate stores used by AWS services to validate outbound TLS connections to customer-configured endpoints, including identity provider endpoints, origin servers, and webhook destinations. We identified CVE-2026-111943, a cryptographic key-generation issue affecting an external Certificate Authority (eMudhra/emSign), whose intermediate CA private keys were trivially recoverable due to catastrophic entropy failures in P-384 key generation. Eight intermediate CA private keys (six TLS, two code-signing) were generated with scalar values of small integers, making them mathematically recoverable without specialized tooling. Please note, customers whose TLS clients enforce certificate revocation checking (OCSP or CRL fail-closed) are not affected, as the issuing CA revoked the affected intermediates on 2026-10-18, and the cross-signing CA revoked its copies on 2026-10-19. Customers running Amazon EC2 Windows Server instances should verify that their instances have received Microsoft's updated certificate trust lists, particularly instances with restricted internet access, disabled automatic certificate updates, or customized certificate stores.

Affected roots:

• AAA Certificate Services (SPKI SHA-256: bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3)
• emSign Root TLS CA – G3 (SPKI SHA-256: c619e4780ed8e0abeda24ad732567de4383a7ea941338f6d1a7d1b49ac792fe9)
• emSign ECC Root CA – G3 (SPKI SHA-256: 8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782)

Current Mitigation Status:

• Root removal changes for the shared AWS trust store were merged and deployed to the live version set on 2026-10-21.
• AWS SDK for Python (boto3 / botocore) was updated and released to PyPI as version 1.43.117.
• Amazon CloudFront has deployed root removal from the edge CA bundle.
• Amazon Linux 2 and Amazon Linux 2023 updates are available now. Customers should update the ca-certificates package. Please follow ALAS CVE-2026-113470, CVE-2026-111943, CVE-2026-91403 and CVE-2026-114406 for more details.
  Amazon Linux golang-based packages are rebuilt with the fixed crypto/x509 package described in CVE-2026-111943 as a defense-in-depth measure against the eMudhra intermediate CA certificates with weak private keys.
  By default, Go programs on Amazon Linux use the system-wide certificate authority (CA) store. Therefore, the primary fix for this issue is the ca-certificates update from CVE-2026-113470 that removes the root CA certificates that signed the affected intermediates. Customers should ensure that update is installed.
  Also note that AAA Certificate Services root has been distrusted and removed from the Amazon Linux system-wide SSL/TLS certificate bundle since mid-2025. CVE-2026-114406 additionally removes these remaining CA certificates that were associated with the same CA operators to ensure no residual trust in those operators remains in the system CA store.
• Amazon Corretto has released updated JDK versions across all supported lines with the affected roots removed.
• Bottlerocket published updated AMIs in v 1.68.0.
• Application Load Balancer has removed affected roots from the trust store used to validate identity provider endpoints for OIDC and JWT authentication. Application Load Balancers with OIDC or JWT authentication enabled have been updated. Customers using OIDC or JWT authentication on Application Load Balancers are being notified through AWS Health. If an identity provider certificate chains to one of the affected roots, replace it with a certificate from an AWS-trusted Certificate Authority by 2026-10-28.
• AWS Security Token Service (STS) and Amazon Cognito have completed deploying trust store updates, removing the affected roots used to validate outbound TLS connections to identity provider endpoints.
• RDS for SQL Server is updated managed hosts to remove the affected roots. No customer action is required.
• Amazon EMR on EC2 has released in all AWS Regions for all supported Amazon EMR release versions. Customers should update when available. For Amazon EMR on EKS we expect the patch be to available by 2026-11-10. For ERM Serverless we expect the patch to be available by 2026-11-16.
• AWS Lambda has made patched images available at Amazon ECR Public Gallery, removing all eMudhra certificates and the impacted AAA Certificate Service certificate entirely. For managed runtimes used by functions deployed as ZIP packages, we have removed all affected certificates for TLS and are in the process of removing for email and object sign verification. We have completed rollout to all functions using Node.js 22, 24 and 26 and expect to complete rollout for other runtimes by November 17, 2026. Starting November 11, 2026, functions using any runtime will also pick up this change during function update.
• AWS Amplify automatically updated customer applications running on Node 22 and Node 24.
• AWS Managed Windows Server AMIs: On 2026-10-26, Microsoft published a security advisory regarding impacted eMudhra certificate authority (CA) private keys and updated its trusted and disallowed certificate lists to prevent affected certificates from being trusted by Windows systems. Windows typically retrieves these updates automatically. A new version of the AWS Managed Windows Server Amazon Machine Images (AMIs) have been released. This release includes out-of-band updates from the Microsoft Update Catalog that update the trusted root certificate payload. Instances launched from these AMIs start with a current set of trusted root certificates, even if they can't reach Microsoft's certificate update service or have automatic certificate trust list (CTL) updates turned off. For more information, see the Windows message center. See Mitigation Guidance for recommended actions.
• Amazon EKS has released updated Amazon EKS-optimized Amazon Linux 2023 AMIs (release v20261023) and updated Amazon EKS Auto Mode AMIs that address this issue. Customers using managed node groups, self-managed nodes, or Karpenter should update their nodes to the release v20261023 or later. EKS Auto Mode automatically replaces existing nodes with the updated AMI, subject to NodePool disruption budgets.
• AWS CodeBuild has released updated curated images and AMIs in all commercial regions as of 2026-10-30. The updated images remove trust in the affected roots from the operating system trust store, the Java trust store, and the AWS CLI. The updated images also include updated Node.js and Go versions. Projects that use the latest curated image receive the update on their next build.
• AWS Network Firewall: AWS Network Firewall is releasing an update to remove the affected certificate authority roots from the trust store used by Network Firewall outbound TLS Inspection. This is expected to be updated in all regions by 11/09.
• AWS Fargate: AWS Fargate has patched the latest platform version. As of 2026-11-01, 4:00 PM PDT, all new Fargate tasks in all AWS Regions run on the patched platform version. Existing tasks are retired according to each customer's task retirement settings.
• Amazon ECS Managed Instances: Amazon ECS Managed Instances has released an updated AMI. Managed instances launched after 2026-11-01, 6:00 AM PDT use it. Existing instances are replaced as part of their regular lifecycle. No customer action is required for service tasks.

Mitigation Guidance:

• Amazon CloudFront: Customers whose origin server certificates chain to one of the three affected roots may experience TLS validation failures as AWS removes the roots from the CloudFront edge CA bundle. Impacted customers have been notified through their Personal Health Dashboard.
  
  
• Elastic Load Balancing (Application Load Balancer): AWS is notifying customers whose Application Load Balancers use OIDC or JWT authentication through AWS Health. If your identity provider endpoint presents a certificate that chains to one of the affected roots, replace it with a certificate from an AWS-trusted Certificate Authority by 2026-10-28.
  
  
• Amazon Corretto: Customers should upgrade to the latest versions, which are now available for download.
  
  
• Amazon Linux 2 and Amazon Linux 2023: Update the ca-certificates package:
  - Amazon Linux 2:
       sudo yum update ca-certificates
  - Amazon Linux 2023/2027
       sudo dnf update ca-certificates --releasever=latest
  
  
• AWS SDK for Python (boto3 / botocore): Update to botocore version 1.43.117 or later:
       pip install --upgrade botocore
  
  
• AWS Lambda: Customers deploying functions as container images should build and redeploy their function from the latest image available. If your function is on Manual or Function Update mode we recommend that you move to Auto mode to take this update. Customers relying on email or object signing within their function code should update their functions to pick up the latest runtime version.

• Amazon EC2 Windows Server instances: Instances with restricted internet access, disabled automatic certificate updates, or customized certificate stores may not have received Microsoft's updated certificate trust lists. Verify that your Windows Server instances have received the latest Microsoft certificate trust updates, paying particular attention to isolated environments and applications that use independent certificate stores. Instances launched from the latest Windows Server AMIs already include the updated trusted root certificate payload, even if they can't reach Microsoft's certificate update service or have automatic CTL updates turned off; existing instances are not changed by the new AMIs, so launch new instances from the latest AMIs or apply the Microsoft updates directly. For additional information, see the Microsoft Security Response Center advisory.
  
  
• AWS CodeBuild:  Projects that use the latest curated image receive the update on their next build. No action is required for these projects. If your project uses a pinned image version, update the project to the latest image version. If you build custom images from a CodeBuild curated image, rebuild your custom images from the latest curated image. If your builds use their own CA bundle, for example the certifi package in your Python dependencies, update that bundle. For available images, see Docker images provided by CodeBuild.
  
  
• AWS Network Firewall
  Customers who use outbound TLS inspection can enable certificate revocation checks and set the action for UNKNOWN and REVOKED certificates to DROP or REJECT. This blocks the affected traffic while the trust stores are being updated. For more information, see Checking certificate revocation status in the AWS Network Firewall documentation.
  
  
• AWS Fargate
  No action is required. AWS retires tasks created before the patch according to your task retirement settings (fargateTaskRetirementWaitPeriod and fargateEventWindows). To apply the update immediately, replace running tasks. For services that use rolling updates, run aws ecs update-service --cluster --service --force-new-deployment. For blue/green deployments with AWS CodeDeploy, create a new deployment with the same task definition revision. For standalone tasks (including tasks started by RunTask, Amazon EventBridge Scheduler, AWS Batch, or AWS Step Functions), stop the running tasks and launch replacements. See Task retirement and maintenance for AWS Fargate.
  
  
• Amazon ECS Managed Instances
  Amazon ECS Managed Instances: No action is required for service tasks. Amazon ECS begins draining each instance 14 days after launch, or earlier to match any event windows you've configured. To apply the update immediately, drain instances with aws ecs update-container-instances-state --cluster <cluster-name> --container-instances <container-instance-id> --status DRAINING. Standalone tasks on a drained instance aren't replaced automatically and must be relaunched. See Patching in Amazon ECS Managed Instances.
  
  
• Bottlerocket: Customers running Bottlerocket-based workloads on Amazon Elastic Kubernetes Service (EKS) or Amazon Elastic Container Service (ECS) on AMI versions at or below v1.67.0 are affected until updated AMIs are available. Customers should apply the interim per-node trust override using the Bottlerocket API:

References:

• CVE-2026-111943

Please email aws-security@amazon.com with any security questions or concerns.