CVE-2026-3336

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3336
Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://aws.amazon.com/security/security-bulletins/2026-005-AWS/ Vendor Advisory
https://github.com/aws/aws-lc/releases/tag/v1.69.0 Release Notes
https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:amazon:aws-lc-sys:*:*:*:*:*:rust:*:*
cpe:2.3:a:amazon:aws_libcrypto:*:*:*:*:*:*:*:*
History

11 Mar 2026, 17:16

Type Values Removed Values Added
CPE cpe:2.3:a:aws:aws_libcrypto:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:aws_libcrypto:*:*:*:*:*:*:*:*
cpe:2.3:a:amazon:aws-lc-sys:*:*:*:*:*:rust:*:*
First Time Amazon aws-lc-sys
Amazon
Amazon aws Libcrypto

09 Mar 2026, 15:09

Type Values Removed Values Added
CPE cpe:2.3:a:aws:aws_libcrypto:*:*:*:*:*:*:*:*
References () https://aws.amazon.com/security/security-bulletins/2026-005-AWS/ - () https://aws.amazon.com/security/security-bulletins/2026-005-AWS/ - Vendor Advisory
References () https://github.com/aws/aws-lc/releases/tag/v1.69.0 - () https://github.com/aws/aws-lc/releases/tag/v1.69.0 - Release Notes
References () https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp - () https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp - Vendor Advisory
First Time Aws aws Libcrypto
Aws
Summary
  • (es) Validación incorrecta de certificados en PKCS7_verify() en AWS-LC permite a un usuario no autenticado eludir la verificación de la cadena de certificados al procesar objetos PKCS7 con múltiples firmantes, excepto el firmante final. Los clientes de los servicios de AWS no necesitan tomar ninguna medida. Las aplicaciones que utilizan AWS-LC deberían actualizarse a la versión 1.69.0 de AWS-LC.

02 Mar 2026, 23:16

Type Values Removed Values Added
References
  • () https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp -

02 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-02 22:16

Updated : 2026-03-11 17:16

NVD link : CVE-2026-3336

Mitre link : CVE-2026-3336

CVE.ORG link : CVE-2026-3336

JSON object : View

Products Affected

amazon

  • aws-lc-sys
  • aws_libcrypto
CWE
CWE-295

Improper Certificate Validation