Amazon Firecracker vulnerabilities

5 CVEs affecting Amazon Firecracker, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-5747, published 2026-04-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-18960, published 2019-12-11. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes.
CVE-2020-27174, published 2020-10-16. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sent to the standard input. This can result in a…
CVE-2020-16843, published 2020-08-04. Medium severity, CVSS 5.9. EPSS: 1.7% chance of exploitation in the next 30 days. In Firecracker 0.20.x before 0.20.1 and 0.21.x before 0.21.2, the network stack can freeze under heavy ingress traffic. This can result in a denial of service on the microVM when it is configured…
CVE-2026-1386, published 2026-01-23. Medium severity, CVSS 6.0. EPSS: 0.2% chance of exploitation in the next 30 days. A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer…
CVE-2026-5747, published 2026-04-08. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. An out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the…