AWS CVE-2026-3338
HIGH
GHSA-hfpc-8r3f-gw53
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionNVD
Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes.
Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
AnalysisAI
PKCS7 signature validation bypass in AWS-LC allows unauthenticated attackers to forge valid signatures on PKCS7 objects containing Authenticated Attributes, potentially enabling malicious code execution or data tampering in applications relying on this cryptographic library. Applications using AWS-LC should immediately upgrade to version 1.69.0, while AWS service customers are not directly impacted. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all systems running AWS-LC library and identify applications processing PKCS7 objects with Authenticated Attributes. Within 7 days: Implement network segmentation to restrict untrusted input sources and enable signature validation logging to detect anomalies. …
Sign in for detailed remediation steps.
More from same product – last 7 days
Command injection in the shell-quote npm package allows attackers who can influence object-token inputs to inject arbitr
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today