PT-2026-44365 · Unknown · Ex Aws Sns

Bernard Duggan + 1 · Published 2026-05-26 · Updated 2026-06-26 · CVE-2026-47074

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ex aws sns versions 2.0.1 through 2.3.4

Description Improper Certificate Validation in the ExAws.SNS and ExAws.SNS.PublicKeyCache modules allows for signature spoofing. The function verify message() fetches the signing certificate from the SigningCertURL field of an incoming SNS message without verifying that the URL uses HTTPS or that the host belongs to an AWS-owned SNS certificate domain. An unauthenticated attacker can provide a controlled SigningCertURL and sign a forged SNS message with their own key, causing the function to return :ok and bypassing signature verification. This occurs when the application exposes an HTTP endpoint that calls verify message() on incoming request bodies.

Recommendations Update ex aws sns to version 2.3.5.

Exploit

Fix

Resource Exhaustion

Improper Certificate Validation

Weakness Enumeration

CWE-400

CWE-295

Related Identifiers

CVE-2026-47074

GHSA-76V6-F83Q-PXVH

GHSA-8JGF-23Q5-X7XX

GHSA-JQ4M-Q6P2-8GWC

Affected Products

Ex Aws Sns

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47074.json · Exploit
• https://github.com/ex-aws/ex_aws_sns/security/advisories/GHSA-8jgf-23q5-x7xx · Vendor Advisory
• https://github.com/ex-aws/ex_aws_sns/commit/1853d280b152d10384a1e21a22cf22152a60be48 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-47074 · Security Note
• https://osv.dev/vulnerability/EEF-CVE-2026-47074 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47077 · Security Note
• https://osv.dev/vulnerability/GHSA-76v6-f83q-pxvh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8jgf-23q5-x7xx · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jq4m-q6p2-8gwc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-47074 · Vendor Advisory
• https://github.com/benoitc/hackney/commit/3d25f9fea26c90609de9d64366fedfe5065413bc · Note
• https://github.com/benoitc/hackney · Note
• https://github.com/benoitc/hackney/security/advisories/GHSA-jq4m-q6p2-8gwc · Note
• https://github.com/ex-aws/ex_aws_sns · Note
• https://github.com · Note