CVE-2026-3336
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Mar 2, 2026
CISA due date
—
The record
Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | aws-lc-sys | 0.24.0 | 0.38.0 |
Related vulnerabilities
- RUSTSEC-2026-0046 PKCS7_verify Certificate Chain Validation Bypass in AWS-LC Same vulnerability
- CVE-2026-4428 A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes… Also affects aws-lc-sys
- RUSTSEC-2026-0048 CRL Distribution Point Scope Check Logic Error in AWS-LC Also affects aws-lc-sys
- RUSTSEC-2026-0044 AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN Also affects aws-lc-sys
- CVE-2026-3338 Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user… Also affects aws-lc-sys
- CVE-2026-3337 Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated… Also affects aws-lc-sys
- RUSTSEC-2026-0045 Timing Side-Channel in AES-CCM Tag Verification in AWS-LC Also affects aws-lc-sys
- RUSTSEC-2026-0047 PKCS7_verify Signature Validation Bypass in AWS-LC Also affects aws-lc-sys