CVE-2026-3338

HIGH

AWS-LC has PKCS7_verify Signature Validation Bypass

Published March 3, 2026Updated March 25, 2026Source: osv

Summary

### Summary AWS-LC is an open-source, general-purpose cryptographic library. ### Impact Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. aws-lc-sys contains code from AWS-LC. Applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys. #### Impacted versions: aws-lc-sys versions: >= 0.24.0, < 0.38.0 ### Patches The patch is included in v0.38.0 ### Workarounds There is no workaround. Applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys. ### Resources If there are any questions or comments about this advisory, contact [AWS/Amazon] Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.

Remediation

Upgrade to the fixed version using your package manager.

Cargo

Update aws-lc-sys to 0.38.0 or later

cargo update -p aws-lc-sys --precise 0.38.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Package	Ecosystem	Affected	Fixed In
aws-lc-sys	crates.io	All versions	0.38.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-347
Improper Verification of Cryptographic SignatureMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Frequently Asked Questions

What is CVE-2026-3338?: AWS-LC has PKCS7_verify Signature Validation Bypass This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2026-3338?: CVE-2026-3338 affects aws-lc-sys. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-3338 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-hfpc-8r3f-gw53

GHSA-jchq-39cv-q4wj

RUSTSEC-2026-0047

Related CVEs

CVE-2026-3336
HIGH
PKCS7_verify Certificate Chain Validation Bypass in AWS-LC
CVE-2026-4428
HIGH
CRL Distribution Point Scope Check Logic Error in AWS-LC
CVE-2026-64679
HIGH
Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation
CVE-2026-63135
HIGH
YOURLS has stored XSS in referrer statistics chart via crafted Referer header
CVE-2026-3337
HIGH
AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
CVE-2026-4428
HIGH
CRL Distribution Point Scope Check Logic Error in AWS-LC
CVE-2026-3336
HIGH
AWS-LC has PKCS7_verify Certificate Chain Validation Bypass
CVE-2026-3337
MEDIUM
Timing Side-Channel in AES-CCM Tag Verification in AWS-LC

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies