CVE-2026-22795 (HIGH): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2026-22795	HIGH	openssl-fips-provider-latest	1:3.2.2-1.amzn2023.0.4	1:3.2.2-1.amzn2023.0.5	2026-01-27T16:16:35.43Z	2026-02-19T10:18:17.288161843Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/provided:latest	public.ecr.aws/lambda/provided@sha256:059ed067a8e796d891100888928e32cde75d63d459617260a7901e217a7249d6
public.ecr.aws/lambda/provided:al2023	public.ecr.aws/lambda/provided@sha256:059ed067a8e796d891100888928e32cde75d63d459617260a7901e217a7249d6
public.ecr.aws/lambda/python:latest	public.ecr.aws/lambda/python@sha256:f1025b56c40ecc2a1b6becc0ae87cadbc31bee42e72dc211170cb2f5a738b1be
public.ecr.aws/lambda/python:3.14	public.ecr.aws/lambda/python@sha256:4a260ea82736166accb2cb9fa1b3a180ca1e26cf5f9714e1e382d290ddb4e409
public.ecr.aws/lambda/python:3.13	public.ecr.aws/lambda/python@sha256:f1025b56c40ecc2a1b6becc0ae87cadbc31bee42e72dc211170cb2f5a738b1be
public.ecr.aws/lambda/python:3.12	public.ecr.aws/lambda/python@sha256:663ac51bfafe5fb4aa9084936611740c97bf9ded30ba815e971fe72971b34d67
public.ecr.aws/lambda/nodejs:latest	public.ecr.aws/lambda/nodejs@sha256:75324e6335efc458856ddcb49429a5806fa66c581529746296ded84f0f8fdd92
public.ecr.aws/lambda/nodejs:24	public.ecr.aws/lambda/nodejs@sha256:2ae0aecfac970190fe1fa2f9de439fb35340d285eb29a715ce6daf18eda7f54c
public.ecr.aws/lambda/nodejs:22	public.ecr.aws/lambda/nodejs@sha256:75324e6335efc458856ddcb49429a5806fa66c581529746296ded84f0f8fdd92
public.ecr.aws/lambda/nodejs:20	public.ecr.aws/lambda/nodejs@sha256:b1d950b97aaedc054c6c9c5409c98cf5c8f29de370a6f344113e1aeeaa441707
public.ecr.aws/lambda/java:latest	public.ecr.aws/lambda/java@sha256:34bc510d30a691091930c6636702697ed3911c3c2bf19c8d4ebae91bb1442204
public.ecr.aws/lambda/java:25	public.ecr.aws/lambda/java@sha256:981df5d83afb63cff2fe55bb85f3102e16df1b1134982c16cc5c92a1e20073ac
public.ecr.aws/lambda/java:21	public.ecr.aws/lambda/java@sha256:34bc510d30a691091930c6636702697ed3911c3c2bf19c8d4ebae91bb1442204
public.ecr.aws/lambda/dotnet:latest	public.ecr.aws/lambda/dotnet@sha256:f7ad6fd594bc06108c7fd6fa5a438f8ceb3e3da37aafec7aa4b7cf976969c376
public.ecr.aws/lambda/dotnet:10	public.ecr.aws/lambda/dotnet@sha256:c1a97e4b055ad61ffb87222bd0f04337a63929efa3bec7dbde4844de94d79856
public.ecr.aws/lambda/dotnet:9	public.ecr.aws/lambda/dotnet@sha256:e0c459f568c3b8c0a601a3141de9a8e4bebd9019210e0ff94381686e7ab0621e
public.ecr.aws/lambda/dotnet:8	public.ecr.aws/lambda/dotnet@sha256:f7ad6fd594bc06108c7fd6fa5a438f8ceb3e3da37aafec7aa4b7cf976969c376
public.ecr.aws/lambda/ruby:latest	public.ecr.aws/lambda/ruby@sha256:215348bc5ef325f108229155601a31d5b6b230995eea50531d85094b63b27f2e
public.ecr.aws/lambda/ruby:3.4	public.ecr.aws/lambda/ruby@sha256:215348bc5ef325f108229155601a31d5b6b230995eea50531d85094b63b27f2e
public.ecr.aws/lambda/ruby:3.3	public.ecr.aws/lambda/ruby@sha256:06a25df7835e1450dc54d81401c063762a885ed8c7e9cfd339dc35286b1b17ef

---

Description

Issue summary: An invalid or NULL pointer dereference can happen in
an application processing a malformed PKCS#12 file.

Impact summary: An application processing a malformed PKCS#12 file can be
caused to dereference an invalid or NULL pointer on memory read, resulting
in a Denial of Service.

A type confusion vulnerability exists in PKCS#12 parsing code where
an ASN1_TYPE union member is accessed without first validating the type,
causing an invalid pointer read.

The location is constrained to a 1-byte address space, meaning any
attempted pointer manipulation can only target addresses between 0x00 and 0xFF.
This range corresponds to the zero page, which is unmapped on most modern
operating systems and will reliably result in a crash, leading only to a
Denial of Service. Exploiting this issue also requires a user or application
to process a maliciously crafted PKCS#12 file. It is uncommon to accept
untrusted PKCS#12 files in applications as they are usually used to store
private keys which are trusted by definition. For these reasons, the issue
was assessed as Low severity.

The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,
as the PKCS12 implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.

OpenSSL 1.0.2 is not affected by this issue.

---

Remediation Steps

• Update the affected package openssl-fips-provider-latest from version 1:3.2.2-1.amzn2023.0.4 to 1:3.2.2-1.amzn2023.0.5.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.