Which versions of AWS-LC are affected by CVE-2026-3338?

AWS-LC, the cryptographic library underlying authentication and data-integrity verification in AWS-backed applications, contains a critical signature verification bypass that could allow attackers to…. A patch is available.

How to fix or mitigate CVE-2026-3338?

Within 24 hours: Conduct discovery of all systems and applications using AWS-LC, aws-lc-sys, or aws_libcrypto through dependency scanning, container registries, and vendor communications. Within 7 days: Upgrade all affected systems to AWS-LC version 1.69.0 or later, test signature verification functionality, and redeploy. Within 30 days: Complete production rollout with full validation of authentication and cryptographic verification systems.

AWS-LC CVE-2026-3338

Q: What is the CVSS score of CVE-2026-3338?

CVE-2026-3338 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-03-02 ff89ba41-3aa1-4d27-914a-91399e9639e5

GHSA-hfpc-8r3f-gw53

Authentication Bypass Jwt Attack Aws Lc Sys Aws Libcrypto Amazon

8.7

CVSS 4.0 · Vendor: ff89ba41-3aa1-4d27-914a-91399e9639e5

Severity by source

Vendor (ff89ba41-3aa1-4d27-914a-91399e9639e5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity signature bypass with no user interaction; impact is purely integrity (I:H), with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (ff89ba41-3aa1-4d27-914a-91399e9639e5).

CVSS VectorVendor: ff89ba41-3aa1-4d27-914a-91399e9639e5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 05:11 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:09 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:08 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:07 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:24 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 03:24 NVD

7.5 (HIGH) 8.7 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 02, 2026 - 22:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes.

Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

AnalysisAI

Signature verification bypass in AWS-LC's PKCS7_verify() function lets unauthenticated attackers get forged PKCS#7 objects containing Authenticated Attributes accepted as validly signed, defeating the integrity guarantee the API exists to provide. It affects applications linking AWS-LC, including the Rust aws-lc-sys binding and aws_libcrypto, and is tagged as enabling JWT/authentication-bypass attacks. No public exploit identified at time of analysis and EPSS is very low (0.03%), but integrity impact is High (CVSS 4.0 8.7) and a fixed release (1.69.0) is already available.

Technical ContextAI

AWS-LC is Amazon's fork of BoringSSL/OpenSSL providing a general-purpose cryptographic library (libcrypto), consumed in C/C++ and through bindings such as the Rust aws-lc-sys crate. The defect is in PKCS7_verify(), the routine validating PKCS#7/CMS signed-data structures. PKCS#7 signed messages may carry 'Authenticated Attributes' (signedAttrs) - a signed attribute set that must include a message digest binding the signature to the actual content. The root cause maps to CWE-347 (Improper Verification of Cryptographic Signature): on the code path where Authenticated Attributes are present, verification is improperly performed, so the cryptographic binding between the signer's signature and the underlying content/digest is not correctly enforced. The same primitive underpins higher-level signed-token constructs, which is why the tags reference JWT attacks.

RemediationAI

Vendor-released patch: AWS-LC 1.69.0 - upgrade AWS-LC and the corresponding aws-lc-sys crate build and aws_libcrypto package to 1.69.0 or later per the AWS security bulletin (https://aws.amazon.com/security/security-bulletins/2026-005-AWS/) and GitHub advisory GHSA-jchq-39cv-q4wj (https://github.com/aws/aws-lc/security/advisories/GHSA-jchq-39cv-q4wj). Red Hat consumers should apply RHSA-2026:5459 (https://access.redhat.com/errata/RHSA-2026:5459) to pick up the rebuilt library. AWS states customers of managed AWS services need take no action because the fix is applied service-side, so the action item is for applications that bundle or statically link AWS-LC. If immediate upgrade is impossible, the targeted compensating control is to stop relying on PKCS7_verify() results for trust decisions on attacker-influenced inputs - specifically, treat verification of PKCS#7 objects carrying Authenticated Attributes as untrusted, or route that verification through a known-good crypto provider, accepting the trade-off of code changes and possible interoperability differences. Network filtering is ineffective here because the flaw is in library logic, not a network service.