What’s Vulnerable › Vulnerabilities

CVE-2026-3336: PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-02 · updated 2026-07-15
• Weakness: CWE-295

Description

Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Affected products

• Amazon Aws-Lc-Sys: from 0.24.0 before 0.38.0 — fixed in 0.38.0
• Amazon Aws Libcrypto: from 1.41.0 before 1.69.0 — fixed in 1.69.0

How to fix

Upgrade to a fixed version: Amazon Aws-Lc-Sys 0.38.0; Amazon Aws Libcrypto 1.69.0. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/2026-005-AWS/
• https://github.com/aws/aws-lc/releases/tag/v1.69.0
• https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp
• https://access.redhat.com/errata/RHSA-2026:5459
• https://access.redhat.com/security/cve/CVE-2026-3336
• https://bugzilla.redhat.com/show_bug.cgi?id=2444026
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3336.json

Get alerted when CVE-2026-3336 or the next vulnerability affects your stack