PT-2026-22702 · Amazon Web Services · Aws-Lc

Joshua Rogers · Published 2026-03-02 · Updated 2026-03-11 · CVE-2026-3336

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions AWS-LC versions prior to 1.69.0

Description A flaw exists in the PKCS7 verify() function within AWS-LC that allows an unauthenticated user to circumvent certificate chain verification when handling PKCS7 objects containing multiple signers, excluding the final signer. This improper certificate validation could potentially allow malicious actors to compromise the integrity of secure communications.

Recommendations Upgrade AWS-LC to version 1.69.0 or later.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-3336

GHSA-CFWJ-9WP5-WQVP

GHSA-VW5V-4F2Q-W9XF

RUSTSEC-2026-0046

Affected Products

Aws-Lc

References · 23

• https://github.com/aws/aws-lc/releases/tag/v1.69.0 · Patch
• https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3336 · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/2026-005-AWS · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2026-0046 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3336 · Security Note
• https://osv.dev/vulnerability/GHSA-vw5v-4f2q-w9xf · Vendor Advisory
• https://github.com/aws/aws-lc-rs · Note
• https://github.com/aws/aws-lc-rs/security/advisories/GHSA-vw5v-4f2q-w9xf · Note
• https://t.me/CVEtracker/46171 · Telegram Post
• https://twitter.com/Sohan_Intel/status/2030536163858186303 · Twitter Post
• https://t.me/cveNotify/155127 · Telegram Post
• https://twitter.com/Huntio/status/2029935081708569050 · Twitter Post
• https://t.me/msrcreports/3311 · Telegram Post
• https://t.me/cveNotify/154813 · Telegram Post