Loading...
Skip to main content
GeekWala

CVE-2026-3338 — Vulnerability in aws-lc-sys — CVE Details

HIGH

AWS-LC has PKCS7_verify Signature Validation Bypass

Published March 3, 2026Updated September 10, 2026Source: osv

Summary

### Summary AWS-LC is an open-source, general-purpose cryptographic library. ### Impact Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. aws-lc-sys contains code from AWS-LC. Applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys. #### Impacted versions: aws-lc-sys versions: >= 0.24.0, < 0.38.0 ### Patches The patch is included in v0.38.0 ### Workarounds There is no workaround. Applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys. ### Resources If there are any questions or comments about this advisory, contact [AWS/Amazon] Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.

Advisory Timeline

  • First published March 3, 2026 (223 days ago).
  • Last revised September 10, 2026 — 190 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Cargo
Update aws-lc-sys to 0.38.0 or later
cargo update -p aws-lc-sys --precise 0.38.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: crates.io (1).

PackageEcosystemAffectedFixed In
aws-lc-sys
crates.io
All versions0.38.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-347
    Improper Verification of Cryptographic SignatureMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Frequently Asked Questions

What is CVE-2026-3338?
AWS-LC has PKCS7_verify Signature Validation Bypass This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2026-3338?
CVE-2026-3338 affects aws-lc-sys. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-3338 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-hfpc-8r3f-gw53
GHSA-jchq-39cv-q4wj
RUSTSEC-2026-0047

Related CVEs

  • CVE-2026-3336
    HIGH

    PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

  • CVE-2026-4428
    HIGH

    CRL Distribution Point Scope Check Logic Error in AWS-LC

  • CVE-2026-93657
    HIGH

    hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

  • CVE-2026-3337
    HIGH

    AWS-LC has Timing Side-Channel in AES-CCM Tag Verification

  • CVE-2026-18140
    HIGH

    aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

  • CVE-2026-4428
    HIGH

    CRL Distribution Point Scope Check Logic Error in AWS-LC

  • CVE-2026-3336
    HIGH

    AWS-LC has PKCS7_verify Certificate Chain Validation Bypass

  • CVE-2026-3337
    MEDIUM

    Timing Side-Channel in AES-CCM Tag Verification in AWS-LC

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies