{"id":"CVE-2026-3336","aliases":["EUVD-2026-9264","GHSA-cfwj-9wp5-wqvp","GHSA-vw5v-4f2q-w9xf","RUSTSEC-2026-0046"],"status":"published","title":"PKCS7_verify Certificate Chain Validation Bypass in AWS-LC","description":"Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.\n\nCustomers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00738,"percentile":0.54804,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2026-03-02T12:00:00Z","modified":"2026-11-09T11:00:04Z","fixes":[{"ecosystem":"crates.io","package":"aws-lc-sys","fixed_in":["0.38.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"aws-lc-sys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0"},{"fixed":"0.38.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"aws-lc-sys","ranges":[{"type":"SEMVER","events":[{"introduced":"0.24.0"},{"fixed":"0.38.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"aws-lc-sys","ranges":[{"type":"SEMVER","events":[{"introduced":"0.24.0"},{"fixed":"0.38.0"}]}]}],"products":[{"vendor":"amazon","product":"aws-lc-sys"},{"vendor":"amazon","product":"aws_libcrypto"},{"vendor":"aws","product":"aws-lc"},{"vendor":"red hat","product":"confidential compute attestation"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift update service"},{"vendor":"red hat","product":"red hat trusted artifact signer 1.3"},{"vendor":"red hat","product":"red hat trusted profile analyzer"}],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-005-AWS/","tags":["vendor-advisory","Vendor Advisory","advisory"]},{"url":"https://github.com/aws/aws-lc/releases/tag/v1.69.0","tags":["patch","Release Notes","fix"]},{"url":"https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp","tags":["third-party-advisory","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3336","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2444026","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3336.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5459","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://github.com/aws/aws-lc-rs/security/advisories/GHSA-vw5v-4f2q-w9xf","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3336","tags":["advisory"]},{"url":"https://aws.amazon.com/security/security-bulletins/2026-005-AWS","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0046.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-vw5v-4f2q-w9xf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3336.json","tags":["advisory"]},{"url":"https://github.com/aws/aws-lc-rs","tags":["package"]},{"url":"https://crates.io/crates/aws-lc-sys","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-3336","title":"PKCS7_verify Certificate Chain Validation Bypass in AWS-LC","description":"Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.\n\nCustomers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.","status":"published","published":"2026-03-02T21:15:16.709Z","modified":"2026-08-21T12:13:00.341Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-295","CWE-295"],"updated_at":"2026-11-02T13:48:58.05327Z"}],"euvd":[{"id":"EUVD-2026-9264","description":"Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.\n\nCustomers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.","status":"published","published":"2026-03-02T21:15:16Z","modified":"2026-08-21T12:13:00Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:37.96401Z"}],"ghsa":[{"id":"GHSA-vw5v-4f2q-w9xf","title":"AWS-LC has PKCS7_verify Certificate Chain Validation Bypass","description":"### Summary\nAWS-LC is an open-source, general-purpose cryptographic library.\n\n### Impact\nImproper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.\n\nCustomers of AWS services do not need to take action. aws-lc-sys contains code from AWS-LC. Applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys.\n\n#### Impacted versions: \naws-lc-sys versions: \u003e= 0.24.0, \u003c 0.38.0\n\n### Patches\nThe patch is included in v0.38.0\n\n### Workarounds\nThere is no workaround. Applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys.\n\n### Resources\nIf there are any questions or comments about this advisory, contact [AWS/Amazon] Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n### Acknowledgement\nAWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process.","status":"published","published":"2026-03-03T20:08:24Z","modified":"2026-03-20T21:31:18Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:39:40.633038Z"}],"nvd":[{"id":"CVE-2026-3336","description":"Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.\n\nCustomers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.","status":"published","published":"2026-03-02T22:16:31.277Z","modified":"2026-07-15T02:20:59.523Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:12:07.420927Z"}],"osv":[{"id":"CVE-2026-3336","title":"PKCS7_verify Certificate Chain Validation Bypass in AWS-LC","description":"Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.\n\nCustomers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.","status":"published","published":"2026-03-02T21:15:16.709Z","modified":"2026-10-28T10:49:31.193983828Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:45:01.896044Z"},{"id":"GHSA-vw5v-4f2q-w9xf","title":"AWS-LC has PKCS7_verify Certificate Chain Validation Bypass","description":"### Summary\nAWS-LC is an open-source, general-purpose cryptographic library.\n\n### Impact\nImproper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.\n\nCustomers of AWS services do not need to take action. aws-lc-sys contains code from AWS-LC. Applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys.\n\n#### Impacted versions: \naws-lc-sys versions: \u003e= 0.24.0, \u003c 0.38.0\n\n### Patches\nThe patch is included in v0.38.0\n\n### Workarounds\nThere is no workaround. Applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys.\n\n### Resources\nIf there are any questions or comments about this advisory, contact [AWS/Amazon] Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n### Acknowledgement\nAWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process.","status":"published","published":"2026-03-03T20:08:24Z","modified":"2026-09-10T03:50:41.273606184Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"RUSTSEC-2026-0046","title":"PKCS7_verify Certificate Chain Validation Bypass in AWS-LC","description":"Improper certificate validation in `PKCS7_verify()` in AWS-LC allows an\nunauthenticated user to bypass certificate chain verification when processing\nPKCS7 objects with multiple signers, except the final signer.\n\nCustomers of AWS services do not need to take action. `aws-lc-sys` contains\ncode from AWS-LC. Applications using `aws-lc-sys` should upgrade to the most\nrecent release of `aws-lc-sys`.\n\nThere is no workaround; applications using `aws-lc-sys` should upgrade to the \nmost recent release of aws-lc-sys.","status":"published","published":"2026-03-02T12:00:00Z","modified":"2026-11-09T11:00:04.012539097Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-09T11:24:16.480676Z"}]}}