Moderate DoS Vulnerabilities in Amazon CloudWatch Agent Fixed

SUSE and openSUSE released updates for the Amazon CloudWatch Agent to address two vulnerabilities: CVE-2026-37236 and CVE-2026-41178. CVE-2026-37236 allows clients to bypass access control by overriding the HTTP method of a POST request, while CVE-2026-41178 permits denial-of-service (DoS) attacks via oversized inputs in baggage parsing. The vulnerabilities affect multiple SUSE Linux Enterprise and openSUSE versions, including Public Cloud Modules. The updates are rated as moderate in severity, and users are advised to apply patches using recommended installation methods. The CVEs were published on August 28, 2026, and June 4, 2026, respectively. Administrators should prioritize patching to mitigate potential risks.

Key Points: • Two vulnerabilities in Amazon CloudWatch Agent fixed: CVE-2026-37236 and CVE-2026-41178. • CVE-2026-37236 allows HTTP method bypass, while CVE-2026-41178 enables DoS via oversized inputs. • Affected systems include SUSE Linux Enterprise and openSUSE versions; patches are available.