PT-2026-26369 · Amazon Web Services · Aws-Lc+2

Published 2026-03-19 · Updated 2026-03-22 · CVE-2026-4428

Positive Technologies · (AI Summary)

CVSS v3.1

7.4

High

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions AWS-LC versions prior to 1.71.0 aws-lc-sys versions 0.15.0 through 0.39.0 aws-lc-fips-sys versions 0.13.0 through 0.13.13

Description A logic error in CRL distribution point validation in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not require action. The issue affects applications using aws-lc-sys and aws-lc-fips-sys.

Recommendations Upgrade AWS-LC to version 1.71.0 or later. Upgrade aws-lc-sys to the most recent release. Upgrade aws-lc-fips-sys to the most recent release. As a workaround, disable CRL checking (X509 V FLAG CRL CHECK). As a workaround, use complete (non-partitioned) CRLs without IDP extensions.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

CWE-299

Related Identifiers

CVE-2026-4428

GHSA-9F94-5G5W-GF6R

RUSTSEC-2026-0042

RUSTSEC-2026-0048

Affected Products

Aws-Lc

Aws-Lc-Fips-Sys

Aws-Lc-Sys

References · 16

• https://github.com/aws/aws-lc/releases/tag/v1.71.0 · Patch
• https://aws.amazon.com/security/security-bulletins/2026-010-AWS · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4428 · Security Note
• https://osv.dev/vulnerability/GHSA-9f94-5g5w-gf6r · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2026-0042 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2026-0048 · Vendor Advisory
• https://github.com/aws/aws-lc-rs/security/advisories/GHSA-9f94-5g5w-gf6r · Note
• https://github.com/aws/aws-lc-rs · Note
• https://rustsec.org/advisories/RUSTSEC-2026-0048.html · Note
• https://crates.io/crates/aws-lc-sys · Note
• https://twitter.com/CVEnew/status/2035627061281198507 · Twitter Post
• https://twitter.com/alex_pulver/status/2034886505273917562 · Twitter Post
• https://twitter.com/infoflowcloud/status/2035627926729728261 · Twitter Post
• https://twitter.com/eyalestrin/status/2035111201563382195 · Twitter Post
• https://crates.io/crates/aws-lc-fips-sys · Note