Threats affecting pkg:github/aws/aws-lc

CVE-2026-4428 is a logic error in AWS-LC versions before 1.71.0 that causes partitioned Certificate Revocation Lists (CRLs) to be incorrectly rejected as out of scope. This flaw allows revoked certificates to bypass revocation checks, potentially enabling use of invalid certificates. The issue is fixed by upgrading to AWS-LC 1.71.0 or AWS-LC-FIPS-3.3.0.

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

CVE-2026-3336 is a high-severity vulnerability in the AWS-LC cryptographic library involving improper certificate validation in the PKCS7_verify() function. This flaw allows an unauthenticated attacker to bypass certificate chain verification for PKCS7 objects with multiple signers, except the final signer, potentially compromising data integrity. AWS customers using AWS services are not required to take action as the vendor manages remediation. Applications using AWS-LC should upgrade to version 1.69.0 to address the issue.