CVE-2026-3336
HIGH
GHSA-vw5v-4f2q-w9xf
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3Tags
Description
Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Analysis
AWS-LC's PKCS7_verify() function fails to properly validate certificate chains in multi-signer scenarios, allowing unauthenticated attackers to forge signatures by bypassing verification of all but the final signer. This affects applications directly using AWS-LC library, though AWS service customers are unaffected. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all systems and applications using AWS-LC, particularly those processing PKCS7-signed documents. Within 7 days: Implement input validation to reject PKCS7 objects with multiple signers until patching is available; review logs for suspicious PKCS7 processing activity. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today