CVE-2026-40468 (HIGH): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2026-40468	HIGH	gawk	5.1.0-3.amzn2023.0.3	5.1.0-3.amzn2023.0.4	2026-07-13T13:16:36.907Z	2026-08-05T10:18:12.738126749Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/provided:latest	public.ecr.aws/lambda/provided@sha256:aa5e0a1b77749a4108e9664cbd385018afcaf7ad1a941687c3b47b943ef6ed70
public.ecr.aws/lambda/provided:al2023	public.ecr.aws/lambda/provided@sha256:aa5e0a1b77749a4108e9664cbd385018afcaf7ad1a941687c3b47b943ef6ed70
public.ecr.aws/lambda/python:latest	public.ecr.aws/lambda/python@sha256:b159321dab22887313f1020bee51c7d42b963bd897999c4921dfc283bd7c9c53
public.ecr.aws/lambda/python:3.14	public.ecr.aws/lambda/python@sha256:b159321dab22887313f1020bee51c7d42b963bd897999c4921dfc283bd7c9c53
public.ecr.aws/lambda/python:3.13	public.ecr.aws/lambda/python@sha256:70e1683986413e2fbdfc8765950d2ef7aaa21a2239726389f92ace0d02fd281c
public.ecr.aws/lambda/python:3.12	public.ecr.aws/lambda/python@sha256:8fb317f01fddcbdcff73205b4a7a3f8faf4580fb56f9582e16f2396ccc24686e
public.ecr.aws/lambda/nodejs:latest	public.ecr.aws/lambda/nodejs@sha256:f482802556ae1ae4b48af2b5548eb425410cccfa77f88776053942de7089262c
public.ecr.aws/lambda/nodejs:24	public.ecr.aws/lambda/nodejs@sha256:f482802556ae1ae4b48af2b5548eb425410cccfa77f88776053942de7089262c
public.ecr.aws/lambda/nodejs:22	public.ecr.aws/lambda/nodejs@sha256:4782203f949dbbf6bdec08a3a91614b2ba0661a74aa99171268856e75fd651c3
public.ecr.aws/lambda/java:latest	public.ecr.aws/lambda/java@sha256:ab272aa801d4a026165442afdab9286812982188b4460e8d427abd746b392e60
public.ecr.aws/lambda/java:25	public.ecr.aws/lambda/java@sha256:ab272aa801d4a026165442afdab9286812982188b4460e8d427abd746b392e60
public.ecr.aws/lambda/java:21	public.ecr.aws/lambda/java@sha256:bb41505e5bd28b93e10183aa0fb6d18336c5d2e7966c0ad44ccbc3f29519e572
public.ecr.aws/lambda/dotnet:latest	public.ecr.aws/lambda/dotnet@sha256:014f1fe947cf393a0d0a60bfc672da7ea886f68b053eab1b95eb29ca91bfea14
public.ecr.aws/lambda/dotnet:10	public.ecr.aws/lambda/dotnet@sha256:014f1fe947cf393a0d0a60bfc672da7ea886f68b053eab1b95eb29ca91bfea14
public.ecr.aws/lambda/dotnet:9	public.ecr.aws/lambda/dotnet@sha256:44917c069a1fb464c77508f5e37de5ad6d31c174277e25903153218d2dddf39e
public.ecr.aws/lambda/dotnet:8	public.ecr.aws/lambda/dotnet@sha256:e4724a3e1dc2d1577af202d3ccf6f3bd126b5b81950f80004d5f2c23bb06e514
public.ecr.aws/lambda/ruby:latest	public.ecr.aws/lambda/ruby@sha256:fba89eabfed0ad818ed086dc49a69b3b519d54a51183725ade45e99344008d09
public.ecr.aws/lambda/ruby:4.0	public.ecr.aws/lambda/ruby@sha256:fba89eabfed0ad818ed086dc49a69b3b519d54a51183725ade45e99344008d09
public.ecr.aws/lambda/ruby:3.4	public.ecr.aws/lambda/ruby@sha256:cd5ca892a90185666607f50011260dc80f09691aee691d9dd31a99f17033ae55
public.ecr.aws/lambda/ruby:3.3	public.ecr.aws/lambda/ruby@sha256:373f8eaf1e4e32242231259de4de4e37fa40f6aa26efeaa50a14f6019b405e5b

---

Description

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.

---

Remediation Steps

• Update the affected package gawk from version 5.1.0-3.amzn2023.0.3 to 5.1.0-3.amzn2023.0.4.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.

[the-lambda-watchdog]

The vulnerability is no longer present in the latest Lambda Watchdog scans. Marking the issue as closed. 🤖