Bundled Python 3.14.6 in AWS CLI v2 installer affected by CVE-2026-15308; please bump to 3.14.7
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
## Summary
The AWS CLI v2 Linux installer still bundles **Python 3.14.6** as `libpython3.14.so.1.0`. That interpreter is affected by [CVE-2026-15308](https://nvd.nist.gov/vuln/detail/CVE-2026-15308) (HTMLParser incremental-parse CPU DoS).
The fix is in **Python 3.14.7**, released 2026-08-05 ([python.org](https://www.python.org/downloads/release/python-3147/), [OSV](https://osv.dev/vulnerability/CVE-2026-15308)). A jump to 3.15 is not required.
This is the same class of request as #10209 (bundled 3.14.3 → 3.14.4 for CVE-2026-4519).
## What we see
Pinned installer `awscli-exe-linux-*-2.35.17.zip` (and the current latest **2.36.22** changelog still only documents the 3.14.6 bump from 2.35.17) ships:
```text
/usr/local/aws-cli/v2/2.35.17/dist/libpython3.14.so.1.0
```
Container scanners (nSpect / similar) report CVE-2026-15308 against that library. Some scanners list the upgrade target as `3.15.0` because the CVE record’s coarse range is “below 3.15.0”; the 3.14 maintenance fix is **3.14.7**.
## Request
Please rebuild the v2 Linux (and other platform) installers with the bundled interpreter at **Python ≥ 3.14.7**, and note the first AWS CLI version that includes it.
## Environment
- AWS CLI v2 **2.35.17** (also checked changelog through **2.36.22**)
- Artifact: `https://awscli.amazonaws.com/awscli-exe-linux-x86_64-2.35.17.zip` (same for aarch64)
- Use case: official installer copied into container images; scanners flag the bundled `libpython`, not the distro `python3`
Contributor guide
Research direction
Start by tracing the build and release inputs that produce the Linux installer artifact and its bundled libpython3.14.so.1.0; the issue does not name a repository source file or test. Rebuild the Linux and other platform installers with Python at least 3.14.7, verify the bundled interpreter version, and document the first AWS CLI version containing it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100