AWS EUVD-2026-13237

Requires AWS-LC versions before 1.71.0 or AWS-LC-FIPS before 3.3.0 with partitioned CRLs configured for certificate revocation checking. Remote attacker must present a revoked certificate during TLS/SSL handshake. No user interaction needed; AC:H suggests specific CRL configuration required.

The CVSS 3.1 score of 7.4 (High) reflects significant risk with network-based attack vector (AV:N), high attack complexity (AC:H), no privileges required (PR:N), and high impact to both confidentiality and integrity (C:H/I:H). The high attack complexity suggests exploitation requires specific conditions or timing, which moderates the risk somewhat. Without EPSS data or KEV listing, there's no evidence of active exploitation in the wild. The authentication bypass tag and the nature of certificate validation failures suggest this could enable man-in-the-middle attacks or unauthorized access to TLS-protected services. However, successful exploitation requires an attacker to already possess a revoked certificate and the target system to use partitioned CRLs, limiting the attack surface. This is a priority for organizations using AWS-LC in production, particularly those with strict certificate validation requirements, but the high complexity and specific preconditions make it less critical than initially suggested by the CVSS score alone.

An attacker with a legitimately issued but subsequently revoked certificate could exploit this vulnerability to bypass certificate revocation checks in systems using vulnerable AWS-LC versions with partitioned CRL validation enabled. The attacker would present their revoked certificate during TLS handshake, and due to the logic error, the certificate would be incorrectly accepted as valid, granting unauthorized access to protected resources or enabling man-in-the-middle attacks. The high attack complexity suggests the attacker would need specific knowledge of the target's CRL configuration and potentially need to time their attack when partitioned CRLs are in use.