🟠 High | Source: AWS Security Bulletins
Two vulnerabilities have been identified in s2n-tls, AWS’s open-source TLS/SSL library. CVE-2026-16317 allows an active man-in-the-middle attacker to silently drop TLS 1.3 application data records without either endpoint detecting the tampering, due to incomplete AEAD authentication coverage. CVE-2026-16318 causes a memory leak in QUIC-enabled TLS 1.3 connections during HelloRetryRequest handshakes, which could be exploited to exhaust server memory over time.
Security Architect’s Take: Audit your use of s2n-tls across services and dependencies — including any AWS-managed services leveraging it — and apply the patched version immediately; prioritise internet-facing TLS 1.3 endpoints and QUIC-enabled workloads as these are directly exploitable by an on-path attacker or through repeated handshake triggering.
Original advisory: CVE-2026-16317 and CVE-2026-16318: Issues with s2n-tls: an open-source implementation of the TLS/SSL protocols