How do I fix "/lib64/libc.so.6: version `GLIBC_2.28' not found"?

When feasible, move to a supported AL2023-based runtime such as python3.12+ or nodejs24.x, then rebuild and test every native dependency on that exact base and architecture. Build the dependency for the exact target: `pip install --platform manylinux2014_x86_64 --only-binary=:all: --target ./package ` (manylinux2014 = glibc 2.17, safe on both AL2 and AL2023). Or build inside the matching base image (`public.ecr.aws/lambda/python:3.12`) so the binary links the runtime's glibc. Match the architecture too — x86_64 vs arm64/Graviton wheels are not interchangeable. Source: https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html

AWS Lambda (native dependency)

/lib64/libc.so.6: version `GLIBC_2.28' not found

/lib64/libc.so.6: version `GLIBC_2.28' not found

What it means

A native binary in your package needs a newer glibc than the Lambda runtime's base OS provides.

Why it happens

Native extensions (cryptography, numpy, pydantic-core, grpcio, psycopg2, plus Go/Rust binaries) link against the glibc of the machine that built them. Lambda's base OS controls the available glibc: AL2-based runtimes, including Python 3.11 and Node.js 18, use glibc 2.26; AL2023-based runtimes, including Python 3.12+ and Node.js 20+, use glibc 2.34. A binary built against a newer glibc cannot load on an older base.

How to fix it

When feasible, move to a supported AL2023-based runtime such as python3.12+ or nodejs24.x, then rebuild and test every native dependency on that exact base and architecture.
Build the dependency for the exact target: `pip install --platform manylinux2014_x86_64 --only-binary=:all: --target ./package <pkg>` (manylinux2014 = glibc 2.17, safe on both AL2 and AL2023).
Or build inside the matching base image (`public.ecr.aws/lambda/python:3.12`) so the binary links the runtime's glibc.
Match the architecture too — x86_64 vs arm64/Graviton wheels are not interchangeable.

Related deadline: Lambda Python 3.9 create/update restrictions — 2027-02-01.

Check configured patterns in your project

The free EOLkits scanner processes files in your browser and flags selected related patterns in supported IaC and dependency files. File names and contents are not uploaded; bounded aggregate file and finding counts may be sent. It is not a complete source or AWS-account scan.

Prefer a 10-second check? Paste your config into the free AWS EOL checker. Pasted input is not uploaded; bounded first-party usage events may be sent.

Primary source: https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html

Inspect the $299 report sample and availability →