AWS FreeRTOS-Plus-TCP V4.4.2 Fixes IPv6 and DNS Validation
Tech GuruQuick Answer
AWS published 2026-139-AWS for two FreeRTOS-Plus-TCP source-validation flaws affecting V4.4.1 and earlier. Inventory embedded builds and forks, upgrade or backport V4.4.2, enable ipconfigDNS_CHECK_REPLY_SOURCE_IP for DNS protection, assess IPv6 RA configuration, rebuild and deploy firmware, validate networking, and retain evidence.
Confirm Scope And Apply The Supported Fix
What to do now: Identify FreeRTOS-Plus-TCP V4.4.1 and earlier in source trees and shipped firmware, map IPv6 RA and DNS configuration, upgrade or backport V4.4.2, explicitly enable ipconfigDNS_CHECK_REPLY_SOURCE_IP, rebuild and sign artifacts, deploy with rollback, test addressing and name resolution, and retain evidence.
Last verified: 2026-10-17 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | FreeRTOS-Plus-TCP IPv6 Router Advertisement handler and DNS resolver |
|---|---|
| Advisory | 2026-139-AWS |
| CVEs | CVE-2026-102551, CVE-2026-102552 |
| Authoritative release date | 2026-10-16 17:15:00 UTC; AWS bulletin publication |
| Authority revision date | No separate revision date is stated by AWS; verified 2026-10-17 UTC |
| Affected versions | FreeRTOS-Plus-TCP V4.4.1 and earlier; the Router Advertisement issue is reachable when IPv6 and RA processing are enabled, while the DNS responder-source issue requires the V4.4.2 control to be enabled after upgrade. |
| Fixed version | FreeRTOS-Plus-TCP V4.4.2 or later, with ipconfigDNS_CHECK_REPLY_SOURCE_IP enabled for CVE-2026-102552, including equivalent fixes in any fork or derivative |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by AWS; no exploitation claim is inferred. |
What Changed
AWS fixed insufficient source validation in IPv6 Router Advertisement and DNS reply handling. A remote third party could influence IPv6 configuration or insert a chosen address into the DNS cache under the advisory conditions. AWS does not provide a CVSS score or exploitation statement.
What To Validate Now
- Inventory. Locate FreeRTOS-Plus-TCP IPv6 Router Advertisement handler and DNS resolver deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: FreeRTOS-Plus-TCP V4.4.1 and earlier; the Router Advertisement issue is reachable when IPv6 and RA processing are enabled, while the DNS responder-source issue requires the V4.4.2 control to be enabled after upgrade. Do not infer applicability from product family or severity alone.
- Remediate. Apply FreeRTOS-Plus-TCP V4.4.2 or later, with ipconfigDNS_CHECK_REPLY_SOURCE_IP enabled for CVE-2026-102552, including equivalent fixes in any fork or derivative through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the resulting version or managed-service state, exercise representative functionality and recovery paths, monitor for regressions, and document exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Upgrading alone does not remediate the DNS issue because reply-source validation is opt-in and disabled by default. If an immediate update is impossible, AWS permits disabling RA or IPv6 where unused and recommends trusted resolver and network-path controls, but states no configuration-only workaround exists for the DNS flaw on older versions.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
