Threats affecting pkg:cargo/aws-lc-sys

CVE-2026-4428 is a logic error in the CRL distribution point matching of AWS-LC that allows revoked certificates to bypass revocation checks during validation when CRL checking is enabled and partitioned CRLs with Issuing Distribution Point extensions are used. Applications using aws-lc-sys versions from 0.15.0 up to but not including 0.39.0 are affected. AWS customers using AWS services do not need to take action. The issue is fixed in aws-lc-sys version 0.39.0.

A logic error in the AWS-LC library's Common Name (CN) validation allows certificates with wildcard or raw UTF-8 Unicode CN values to bypass name constraints enforcement. This occurs because the function responsible for CN validation does not recognize these CN patterns as valid DNS identifiers, causing the name constraints check to be skipped. However, hostname verification still accepts these CN values when no dNSName Subject Alternative Name (SAN) is present, enabling bypass of name constraints. Applications using aws-lc-sys versions from 0.32.0 up to but not including 0.39.0 are affected. Customers of AWS services do not need to take action. The issue is fixed in version 0.39.0.

CVE-2026-3338 is a high-severity vulnerability in the aws-lc-sys library, specifically in the PKCS7_verify() function of AWS-LC. It allows an unauthenticated attacker to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. This flaw affects aws-lc-sys versions from 0.24.0 up to, but not including, 0.38.0. There is no workaround; users should upgrade to version 0.38.0 or later. Customers of AWS cloud services are not impacted and do not need to take action.

CVE-2026-3336 is a vulnerability in the AWS-LC cryptographic library's PKCS7_verify() function that allows unauthenticated users to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. This flaw affects aws-lc-sys versions from 0.24.0 up to but not including 0.38.0. The issue has been fixed in version 0.38.0. There is no workaround; users should upgrade to the latest release to mitigate this vulnerability. Customers using AWS cloud services are not required to take action as the vendor manages remediation for those services.

A timing side-channel vulnerability exists in the AES-CCM tag verification implementation in aws-lc-sys versions from 0.14.0 up to but not including 0.38.0. This flaw allows an unauthenticated attacker to potentially determine the validity of authentication tags by measuring timing discrepancies during decryption. The issue affects the EVP CIPHER API implementations EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. AWS customers using AWS services are not required to take action, but applications using aws-lc-sys should upgrade to version 0.38.0 or later. Workarounds exist only for specific AES-CCM parameter sets by using the EVP AEAD API with certain implementations; otherwise, upgrading is necessary.