CVE-2026-3337
Medium · 5.9CVSS
5.9
EPSS
0.5%
Published
Mar 2, 2026
CISA due date
—
The record
Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | aws-lc-fips-sys | 0.13.0 | 0.13.12 |
| crates.io | aws-lc-sys | 0.14.0 | 0.38.0 |
Related vulnerabilities
- RUSTSEC-2026-0045 Timing Side-Channel in AES-CCM Tag Verification in AWS-LC Same vulnerability
- CVE-2026-4428 A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes… Also affects aws-lc-fips-sys
- RUSTSEC-2026-0048 CRL Distribution Point Scope Check Logic Error in AWS-LC Also affects aws-lc-fips-sys
- RUSTSEC-2026-0044 AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN Also affects aws-lc-sys
- CVE-2026-3338 Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user… Also affects aws-lc-sys
- CVE-2026-3336 Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated… Also affects aws-lc-sys
- RUSTSEC-2026-0047 PKCS7_verify Signature Validation Bypass in AWS-LC Also affects aws-lc-sys
- RUSTSEC-2026-0046 PKCS7_verify Certificate Chain Validation Bypass in AWS-LC Also affects aws-lc-sys