RUSTSEC-2026-0045
Medium · 5.9CVSS
5.9
EPSS
—
Published
Mar 2, 2026
CISA due date
—
The record
Timing Side-Channel in AES-CCM Tag Verification in AWS-LC
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | aws-lc-fips-sys | 0.13.0 | 0.13.12 |
| crates.io | aws-lc-sys | 0.14.0 | 0.38.0 |
Related vulnerabilities
- CVE-2026-3337 Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated… Same vulnerability
- CVE-2026-4428 A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes… Also affects aws-lc-fips-sys
- RUSTSEC-2026-0048 CRL Distribution Point Scope Check Logic Error in AWS-LC Also affects aws-lc-fips-sys
- RUSTSEC-2026-0044 AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN Also affects aws-lc-sys
- CVE-2026-3338 Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user… Also affects aws-lc-sys
- CVE-2026-3336 Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated… Also affects aws-lc-sys
- RUSTSEC-2026-0047 PKCS7_verify Signature Validation Bypass in AWS-LC Also affects aws-lc-sys
- RUSTSEC-2026-0046 PKCS7_verify Certificate Chain Validation Bypass in AWS-LC Also affects aws-lc-sys