PT-2026-22703 · Amazon Web Services · Aws-Lc

Joshua Rogers · Published 2026-03-02 · Updated 2026-03-11 · CVE-2026-3337

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions AWS-LC versions prior to 1.69.0

Description An observable timing discrepancy in AES-CCM decryption within AWS-LC could allow an unauthenticated user to potentially determine authentication tag validity through timing analysis. The impacted implementations utilize the EVP CIPHER API, specifically EVP aes 128 ccm, EVP aes 192 ccm, and EVP aes 256 ccm.

Recommendations Upgrade to AWS-LC version 1.69.0.

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2026-3337

GHSA-65P9-R9H6-22VJ

GHSA-FRMV-5GCM-JWXH

RUSTSEC-2026-0043

RUSTSEC-2026-0045

Affected Products

Aws-Lc

References · 25

• https://github.com/aws/aws-lc/releases/tag/v1.69.0 · Patch
• https://github.com/aws/aws-lc/security/advisories/GHSA-frmv-5gcm-jwxh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3337 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2026-0043 · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/2026-005-AWS · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3337 · Security Note
• https://osv.dev/vulnerability/GHSA-65p9-r9h6-22vj · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2026-0045 · Vendor Advisory
• https://github.com/aws/aws-lc-rs · Note
• https://github.com/aws/aws-lc-rs/security/advisories/GHSA-65p9-r9h6-22vj · Note
• https://twitter.com/infoflowcloud/status/2028590102218166655 · Twitter Post
• https://twitter.com/CVEnew/status/2028588959186534445 · Twitter Post
• https://t.me/cveNotify/155128 · Telegram Post
• https://twitter.com/Huntio/status/2029935081708569050 · Twitter Post
• https://twitter.com/cyberbivash/status/2028642309244424328 · Twitter Post