What’s Vulnerable › Vulnerabilities

CVE-2026-3338: PKCS7_verify Signature Validation Bypass in AWS-LC

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-02 · updated 2026-07-15
• Weakness: CWE-347

Description

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Affected products

• Amazon Aws-Lc-Sys: from 0.24.0 before 0.38.0 — fixed in 0.38.0
• Amazon Aws Libcrypto: from 1.41.0 before 1.69.0 — fixed in 1.69.0

How to fix

Upgrade to a fixed version: Amazon Aws-Lc-Sys 0.38.0; Amazon Aws Libcrypto 1.69.0. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/2026-005-AWS/
• https://github.com/aws/aws-lc/releases/tag/v1.69.0
• https://github.com/aws/aws-lc/security/advisories/GHSA-jchq-39cv-q4wj
• https://access.redhat.com/errata/RHSA-2026:5459
• https://access.redhat.com/security/cve/CVE-2026-3338
• https://bugzilla.redhat.com/show_bug.cgi?id=2444025
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3338.json

Get alerted when CVE-2026-3338 or the next vulnerability affects your stack