AWS has released an important bulletin regarding two vulnerabilities in its s2n-tls library. The first, CVE-2026-16317, is a silent drop of TLS 1.3 encrypted records. This flaw allows a man-in-the-middle attacker to remove individual data records without detection. The issue arises because the outer content type byte is not validated against the required application_data value in TLS 1.3. Consequently, this vulnerability affects all TLS 1.3 connections for both clients and servers. TLS 1.2 and QUIC connections are not impacted by this specific issue. The second vulnerability, CVE-2026-16318, is a memory leak in QUIC transport parameters. This occurs during the HelloRetryRequest phase of QUIC-enabled TLS 1.3 connections. Improper memory allocation management leads to a leak each time a HelloRetryRequest is processed. This can lead to increased memory usage on long-running servers. Only deployments utilizing QUIC are affected by this memory leak. Both vulnerabilities impact s2n-tls versions up to and including v1.7.5. Users are advised to consult the linked article for comprehensive details.