This update for amazon-ecs-init fixes the following issues:
- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS
servers (bsc#1279042).
- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames
containing a crafted header value type byte outside the valid range can cause the host process to terminate
(bsc#1280679).
Changes for amazon-ecs-init:
- Update to version 1.108.0
* Enhancement - Add ECS-Init install pointer for non-Amazon Linux
AMIs to README (#5161)
* Enhancement - Remove direct docker run instructions fro
This update for amazon-ecs-init fixes the following issues:
- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS
via oversized inputs (bsc#1276744).
- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization
policies via mixed-case or canonical-case header matches (bsc#1279329).
- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279231).
Changes for amazon-ecs-init:
- Update to version 1.107.0
* Feature - Add MPS GPU Sharing capability (#5139)
* Enhance
This update for amazon-ecs-init fixes the following issue:
Update to version 1.106.0.
Security issues fixed:
- CVE-2026-10722: github.com/cilium/ebpf: interger overflow when performing BTF string offset boundary check can lead
to crash when malformed ELF/BTF input is parsed (bsc#1267794).
Other updates and bugfixes:
- Version 1.106.0:
* Feature - Feature - Add FIS-driven DNS refresh add-sources endpoint
for network-latency and network-packet-loss faults (#5029)
* Enhancement - Enhancement: Update SSM Agent version to 3.3.4624.0
for ECS exec (#5054)
* Enhancement - Backfill host DNS config on isolated platform (#5047)
*
This update for amazon-ecs-init fixes the following issue
- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272128).
This update for amazon-ecs-init fixes the following issues
Update to version 1.103.2:
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265843).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266652).
Changes:
* Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/fsx from
1.53.1 to 1.65.10 in /agent (#4966)
* Enhancement - Add semgrep security scan for command injection (#4959)
* Enhancement - Bump golang.org/x/tools from 0.39.0 to 0.45.0 in
/ecs-agen