# ALAS2023-2026-2149: ecs-service-connect-agent security update

ALAS2023-2026-2149, released September 14, 2026, fixes 13 CVEs in ecs-service-connect-agent (version v1.39.1.0-1.amzn2023). None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-2149
- Platform: Linux
- Released: Sep 14, 2026
- Priority: High (Closes CVE-2026-73512, high severity)
- CVEs: 13, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-2149.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [ecs-service-connect-agent](https://patchblox.com/security/data/product/linux/ecs-service-connect-agent.md) | amzn 2023 | v1.39.1.0-1.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-73512](https://patchblox.com/security/data/cve/CVE-2026-73512.md) | High | ecs-service-connect-agent: Fixed a use-after-free in the QUIC HTTP datagram handler where late HTTP/3 datagrams could reference a stream decoder... | n/a | 0.0087 |  |
| [CVE-2026-48521](https://patchblox.com/security/data/cve/CVE-2026-48521.md) | High | ecs-service-connect-agent: An Envoy proxy handling HTTP/3 connections can dereference a null transport socket option during the selection of a c... | n/a | 0.0074 |  |
| [CVE-2026-50572](https://patchblox.com/security/data/cve/CVE-2026-50572.md) | High | ecs-service-connect-agent: Fixed a use-after-free in the ext_authz raw HTTP client where completing an authorization request could destroy the c... | n/a | 0.0068 |  |
| [CVE-2026-73546](https://patchblox.com/security/data/cve/CVE-2026-73546.md) | High | ecs-service-connect-agent: Fixed a stored cross-site scripting issue in the HTML stats interface (/stats?format=html) where dynamically named st... | n/a | 0.0062 |  |
| [CVE-2026-73549](https://patchblox.com/security/data/cve/CVE-2026-73549.md) | High | ecs-service-connect-agent: Fixed an abnormal process termination for scoped IPv6 client addresses in original DST clusters with HTTP/3. | n/a | 0.0062 |  |
| [CVE-2026-73547](https://patchblox.com/security/data/cve/CVE-2026-73547.md) | High | ecs-service-connect-agent: Fixed an abnormal process termination in the ext_authz filter when processing CONNECT requests without a :path pseudo... | n/a | 0.0055 |  |
| [CVE-2026-73550](https://patchblox.com/security/data/cve/CVE-2026-73550.md) | High | ecs-service-connect-agent: Fixed an HTTP/2 memory-exhaustion issue where discarded duplicate Host headers were not counted toward request-header... | n/a | 0.0055 |  |
| [CVE-2026-73551](https://patchblox.com/security/data/cve/CVE-2026-73551.md) | High | ecs-service-connect-agent: Fixed URL normalization of dot and dot-dot path segments containing parameters, which could cause access-control comp... | n/a | 0.0053 |  |
| [CVE-2026-73553](https://patchblox.com/security/data/cve/CVE-2026-73553.md) | High | ecs-service-connect-agent: Fixed an authorization bypass when ignore_path_parameters_in_path_matching was enabled, where a path such as /admin;x... | n/a | 0.0051 |  |
| [CVE-2026-73513](https://patchblox.com/security/data/cve/CVE-2026-73513.md) | High | ecs-service-connect-agent: Fixed a heap use-after-free where an untrusted upstream could send HTTP/2 response trailers without the END_STREAM fl... | n/a | 0.0049 |  |
| [CVE-2026-73552](https://patchblox.com/security/data/cve/CVE-2026-73552.md) | High | ecs-service-connect-agent: Fixed an issue where safe_regex matching treated accepted non-UTF-8 HTTP header bytes as a non-match; in RBAC policie... | n/a | 0.0049 |  |
| [CVE-2026-73548](https://patchblox.com/security/data/cve/CVE-2026-73548.md) | High | ecs-service-connect-agent: Fixed cross-user response poisoning involving generic, non-WebSocket HTTP upgrades, where request payload sent before... | n/a | 0.0047 |  |
| [CVE-2026-73511](https://patchblox.com/security/data/cve/CVE-2026-73511.md) | High | ecs-service-connect-agent: Fixed path matching for paths containing per-segment parameters, where Envoy and backends could select different reso... | n/a | 0.0038 |  |

---

Data as of 2026-11-11T13:47:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.