CVE-2026-4428
High · 7.4CVSS
7.4
EPSS
0.3%
Published
Mar 19, 2026
CISA due date
—
The record
A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should upgrade to AWS-LC 1.71.0 or AWS-LC-FIPS-3.3.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | aws-lc-fips-sys | 0.13.0 | 0.13.13 |
| crates.io | aws-lc-sys | 0.15.0 | 0.39.0 |
Related vulnerabilities
- RUSTSEC-2026-0048 CRL Distribution Point Scope Check Logic Error in AWS-LC Same vulnerability
- CVE-2026-3337 Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated… Also affects aws-lc-fips-sys
- RUSTSEC-2026-0045 Timing Side-Channel in AES-CCM Tag Verification in AWS-LC Also affects aws-lc-fips-sys
- RUSTSEC-2026-0044 AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN Also affects aws-lc-sys
- CVE-2026-3338 Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user… Also affects aws-lc-sys
- CVE-2026-3336 Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated… Also affects aws-lc-sys
- RUSTSEC-2026-0047 PKCS7_verify Signature Validation Bypass in AWS-LC Also affects aws-lc-sys
- RUSTSEC-2026-0046 PKCS7_verify Certificate Chain Validation Bypass in AWS-LC Also affects aws-lc-sys