← Vulnerability feed

Vulnerability record · CVE-2020-27174 · published 16 October 2020

CVE-2020-27174: Amazon firecracker memory leak vulnerability

Amazon · Firecracker

In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sent to the standard input. This can result in a memory leak on the microVM emulation thread, possibly occupying more memory than intended on the host.

7.5 CVSS 3.1 High EPSS 1.7% · top 23.2% CWE-401 · Memory leak
7.5CVSS 3.1 base score, v2 5.0
1.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sent to the standard input. This can result in a memory leak on the microVM emulation thread, possibly occupying more memory than intended on the host.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.openwall.com/lists/oss-security/2020/10/23/1 Third Party Advisory
https://github.com/firecracker-microvm/firecracker/issues/2177 Third Party Advisory
https://github.com/firecracker-microvm/firecracker/pull/2178 PatchThird Party Advisory
https://github.com/firecracker-microvm/firecracker/pull/2179 PatchThird Party Advisory
http://www.openwall.com/lists/oss-security/2020/10/23/1 Third Party Advisory
https://github.com/firecracker-microvm/firecracker/issues/2177 Third Party Advisory
https://github.com/firecracker-microvm/firecracker/pull/2178 PatchThird Party Advisory
https://github.com/firecracker-microvm/firecracker/pull/2179 PatchThird Party Advisory

Track CVE-2020-27174 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-18960Amazon firecracker classic buffer overflow vulnerabilityFirecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes.EPSS 3.3%8.7CVE-2026-5747Amazon firecracker divide by zero vulnerabilityAn out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local gu…EPSS 0.21%6.0CVE-2026-1386Amazon firecracker vulnerabilityA UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host us…EPSS 0.22%5.9CVE-2020-16843Amazon firecracker vulnerabilityIn Firecracker 0.20.x before 0.20.1 and 0.21.x before 0.21.2, the network stack can freeze under heavy ingress traffic. This can result in a denial o…EPSS 1.7%3.3CVE-2023-26083Arm Mali GPU Kernel Driver memory leak exposes kernel metadataThe Arm Mali GPU kernel driver has a memory leak (CWE-401) across Midgard r6p0-r32p0, Bifrost r0p0-r42p0, Valhall r19p0-r42p0, and Avalon r41p0-r42p0…KEVEPSS 1.2%analysed8.6CVE-2018-0158Cisco IOS and IOS XE IKEv2 packet handling memory leak DoSCisco IOS and IOS XE mishandle certain IKEv2 packets, causing improper input validation that leaks memory. Repeated crafted packets drive continuous …KEVEPSS 7.2%analysed

Source: NIST National Vulnerability Database (record CVE-2020-27174), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.