Threats affecting pkg:cargo/aws-lc-fips-sys

CVE-2026-4428 is a logic error in the CRL distribution point matching of AWS-LC that allows revoked certificates to bypass revocation checks during validation when CRL checking is enabled and partitioned CRLs with Issuing Distribution Point extensions are used. This affects aws-lc-fips-sys versions from 0.13.0 up to but not including 0.13.13. Applications using complete CRLs without IDP extensions or those not enabling CRL checking are not affected. A fix is available in version 0.13.13. Customers of AWS services do not need to take action as this does not affect AWS cloud services directly.

CVE-2026-3337 is a timing side-channel vulnerability in the AES-CCM tag verification implementation of AWS-LC's EVP CIPHER API. An unauthenticated attacker can potentially determine the validity of authentication tags by measuring timing discrepancies during AES-CCM decryption. The affected functions are EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm in aws-lc-fips-sys versions >=0.13.0 and <0.13.12. AWS customers using cloud services are not required to take action. Applications using aws-lc-fips-sys should upgrade to version 0.13.12 or later. Workarounds exist only for specific AES-CCM parameter sets by using the EVP AEAD API variants.