Attributed metadata history
Up to 100 retained publisher events per page for df136bc26c21e12b8c49cc1d4982194c7122b62ed9e0050bee369fc34302588d. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_b35573840dfc5ce6da
observed · 2026-10-12 14:29:02 UTC
available
Fingerprint: 596c214e60f67af37a9e8175e4f5cd1a8ccaa6da5d5c0b2911f426d14b9208a6
intelligence_src_b35573840dfc5ce6da
observed · 2026-10-12 14:29:02 UTC
Bulletin ID: 2026-109-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/11/2026 09:30 AM PDT Description: The AWS Advanced JDBC Wrapper is an open-source library that enhances existing JDBC drivers with AWS-specific capabilities such as Aurora failover, IAM authentication, and automated SQL query caching for applications connecting to Amazon Aurora, RDS MySQL, and RDS MariaDB. We identified CVE-2026-18061, an improper restriction of XML external entity (XXE) references in the optional RemoteQueryCachePlugin. When this plugin is enabled with a shared cache, an actor with write access to that cache infrastructure might place crafted XML in a cached column value. When an application subsequently reads that cached result as XML, the wrapper's XML parsers resolve external entities, which might allow the actor to disclose sensitive files readable by the application process, including stored database and IAM role credentials. Impacted versions: >= 3.3.0 and <= 4.2.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Fingerprint: 1423cf08da751e3041ada2debecbfedb5dbe28dfd4efe274422830818d3b8e0f