CVE-2026-4428: CWE-299 Improper check for certificate revocation in AWS AWS-LC
Bulletin ID: 2026-010-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/03/19 13:30 PM PDT Description: AWS-LC is a general-purpose cryptographic library maintained by AWS. We identified CVE-2026-4428 affecting X.509 certificate verification. A logic error in the CRL (Certificate Revocation List) distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Applications that do not enable CRL checking (X509_V_FLAG_CRL_CHECK) are not affected. Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Impacted versions: - CRL Distribution Point Scope Check Logic Error in AWS-LC >= v1.24.0, = AWS-LC-FIPS-3.0.0, = v0.15.0, = v0.13.0, < v0.13.13 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
AI Analysis
Technical Summary
CVE-2026-4428 is a vulnerability in AWS-LC before version 1.71.0 involving improper validation of CRL distribution points due to a logic error. This causes partitioned CRLs to be mistakenly treated as out of scope, allowing revoked certificates to bypass revocation checks. The issue affects AWS-LC versions including 1.24.0. The vulnerability is classified under CWE-299 (Improper Check for Certificate Revocation). The CVSS 3.1 base score is 7.4 with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity. The vendor has released a fix in AWS-LC version 1.71.0.
Potential Impact
The vulnerability allows revoked certificates to bypass revocation checks due to incorrect handling of partitioned CRLs. This can lead to acceptance of revoked certificates, potentially compromising confidentiality and integrity of communications relying on AWS-LC for certificate validation. There are no reports of known exploits in the wild.
Mitigation Recommendations
A fix is available by upgrading AWS-LC to version 1.71.0 or later. Users of affected versions should apply this update to resolve the vulnerability. Since this is a library, ensure that all dependent applications and services are rebuilt or updated accordingly. Patch status is confirmed by the vendor advisory indicating the fix is included in version 1.71.0.
CVE-2026-4428: CWE-299 Improper check for certificate revocation in AWS AWS-LC
Description
Bulletin ID: 2026-010-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/03/19 13:30 PM PDT Description: AWS-LC is a general-purpose cryptographic library maintained by AWS. We identified CVE-2026-4428 affecting X.509 certificate verification. A logic error in the CRL (Certificate Revocation List) distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Applications that do not enable CRL checking (X509_V_FLAG_CRL_CHECK) are not affected. Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Impacted versions: - CRL Distribution Point Scope Check Logic Error in AWS-LC >= v1.24.0, = AWS-LC-FIPS-3.0.0, = v0.15.0, = v0.13.0, < v0.13.13 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
CVSS v3.1
Score 7.4high
Affected software
AWS
AWS-LC
AWS
AWS-LC-FIPS
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-4428 is a vulnerability in AWS-LC before version 1.71.0 involving improper validation of CRL distribution points due to a logic error. This causes partitioned CRLs to be mistakenly treated as out of scope, allowing revoked certificates to bypass revocation checks. The issue affects AWS-LC versions including 1.24.0. The vulnerability is classified under CWE-299 (Improper Check for Certificate Revocation). The CVSS 3.1 base score is 7.4 with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity. The vendor has released a fix in AWS-LC version 1.71.0.
Potential Impact
The vulnerability allows revoked certificates to bypass revocation checks due to incorrect handling of partitioned CRLs. This can lead to acceptance of revoked certificates, potentially compromising confidentiality and integrity of communications relying on AWS-LC for certificate validation. There are no reports of known exploits in the wild.
Mitigation Recommendations
A fix is available by upgrading AWS-LC to version 1.71.0 or later. Users of affected versions should apply this update to resolve the vulnerability. Since this is a library, ensure that all dependent applications and services are rebuilt or updated accordingly. Patch status is confirmed by the vendor advisory indicating the fix is included in version 1.71.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMZN
- Date Reserved
- 2026-03-19T13:42:59.783Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69bc6600e32a4fbe5ff98437
Added to database: 03/19/2026, 21:09:20 UTC
Last enriched: 06/05/2026, 19:30:10 UTC
Last updated: 09/10/2026, 19:36:54 UTC
Views: 301
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.