CVE-2026-3338
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Mar 2, 2026
CISA due date
—
The record
Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | aws-lc-sys | 0.24.0 | 0.38.0 |
Related vulnerabilities
- RUSTSEC-2026-0047 PKCS7_verify Signature Validation Bypass in AWS-LC Same vulnerability
- CVE-2026-4428 A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes… Also affects aws-lc-sys
- RUSTSEC-2026-0048 CRL Distribution Point Scope Check Logic Error in AWS-LC Also affects aws-lc-sys
- RUSTSEC-2026-0044 AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN Also affects aws-lc-sys
- CVE-2026-3337 Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated… Also affects aws-lc-sys
- CVE-2026-3336 Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated… Also affects aws-lc-sys
- RUSTSEC-2026-0045 Timing Side-Channel in AES-CCM Tag Verification in AWS-LC Also affects aws-lc-sys
- RUSTSEC-2026-0046 PKCS7_verify Certificate Chain Validation Bypass in AWS-LC Also affects aws-lc-sys