High severity · published Mar 2, 2026
CVE-2026-3336
PKCS7_verify Certificate Chain Validation Bypass in AWS-LC
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.
Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AW
AWS-LC · AWS
1.41.0 before 1.69.0 · source: vendor
AL
Aws Libcrypto · Amazon
1.41.0 before 1.69.0 · source: NVD
AW
Aws-lc-sys · Amazon
0.24.0 before 0.38.0 · source: NVD
CC
Confidential Compute Attestation · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift Container Platform 4 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Trusted Artifact Signer 1.3 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Trusted Profile Analyzer · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3336
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3336
Vendor Advisory
https://aws.amazon.com/security/security-bulletins/2026-005-AWS/
Release Notes
https://github.com/aws/aws-lc/releases/tag/v1.69.0
Vendor Advisory
https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:5459
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-3336
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2444026
More from AWS-LC
7.5
CVE-2026-3338
PKCS7_verify Signature Validation Bypass in AWS-LC
7.4
CVE-2026-4428
CRL Distribution Point Scope Check Logic Error in AWS-LC
5.9
CVE-2026-3337
Timing Side-Channel in AES-CCM Tag Verification in AWS-LC