Linux · 
Amazon Linux · Security advisory · September 14, 2026
Amazon Linux · Security advisory · September 14, 2026ALAS2023-2026-2149: ecs-service-connect-agent security update
ALAS2023-2026-2149, released September 14, 2026, fixes 13 CVEs in ecs-service-connect-agent (version v1.39.1.0-1.amzn2023). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
13
None rated Critical
Exploited
0
None reported
Highest CVSS
n/a
No CVSS score published
Highest EPSS
0.0087
59th percentile
Priority of the 13 CVEs
Patch now 0
Urgent 0
High 13
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| ecs-service-connect-agent | amzn 2023 | v1.39.1.0-1.amzn2023 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2026-73512 | ecs-service-connect-agent: Fixed a use-after-free in the QUIC HTTP datagram handler where late HTTP/3 datagrams could reference a stream decoder... | n/a | 0.0087 | None reported |
| High | CVE-2026-48521 | ecs-service-connect-agent: An Envoy proxy handling HTTP/3 connections can dereference a null transport socket option during the selection of a c... | n/a | 0.0074 | None reported |
| High | CVE-2026-50572 | ecs-service-connect-agent: Fixed a use-after-free in the ext_authz raw HTTP client where completing an authorization request could destroy the c... | n/a | 0.0068 | None reported |
| High | CVE-2026-73546 | ecs-service-connect-agent: Fixed a stored cross-site scripting issue in the HTML stats interface (/stats?format=html) where dynamically named st... | n/a | 0.0062 | None reported |
| High | CVE-2026-73549 | ecs-service-connect-agent: Fixed an abnormal process termination for scoped IPv6 client addresses in original DST clusters with HTTP/3. | n/a | 0.0062 | None reported |
| High | CVE-2026-73547 | ecs-service-connect-agent: Fixed an abnormal process termination in the ext_authz filter when processing CONNECT requests without a :path pseudo... | n/a | 0.0055 | None reported |
| High | CVE-2026-73550 | ecs-service-connect-agent: Fixed an HTTP/2 memory-exhaustion issue where discarded duplicate Host headers were not counted toward request-header... | n/a | 0.0055 | None reported |
| High | CVE-2026-73551 | ecs-service-connect-agent: Fixed URL normalization of dot and dot-dot path segments containing parameters, which could cause access-control comp... | n/a | 0.0053 | None reported |
| High | CVE-2026-73553 | ecs-service-connect-agent: Fixed an authorization bypass when ignore_path_parameters_in_path_matching was enabled, where a path such as /admin;x... | n/a | 0.0051 | None reported |
| High | CVE-2026-73513 | ecs-service-connect-agent: Fixed a heap use-after-free where an untrusted upstream could send HTTP/2 response trailers without the END_STREAM fl... | n/a | 0.0049 | None reported |
| High | CVE-2026-73552 | ecs-service-connect-agent: Fixed an issue where safe_regex matching treated accepted non-UTF-8 HTTP header bytes as a non-match; in RBAC policie... | n/a | 0.0049 | None reported |
| High | CVE-2026-73548 | ecs-service-connect-agent: Fixed cross-user response poisoning involving generic, non-WebSocket HTTP upgrades, where request payload sent before... | n/a | 0.0047 | None reported |
| High | CVE-2026-73511 | ecs-service-connect-agent: Fixed path matching for paths containing per-segment parameters, where Envoy and backends could select different reso... | n/a | 0.0038 | None reported |
Showing 1 to 13 of 13
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.