Threats tagged 'rustsec-2026-0043'

CVE-2026-3337 is a timing side-channel vulnerability in the AES-CCM tag verification implementation of AWS-LC's EVP CIPHER API. An unauthenticated attacker can potentially determine the validity of authentication tags by measuring timing discrepancies during AES-CCM decryption. The affected functions are EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm in aws-lc-fips-sys versions >=0.13.0 and <0.13.12. AWS customers using cloud services are not required to take action. Applications using aws-lc-fips-sys should upgrade to version 0.13.12 or later. Workarounds exist only for specific AES-CCM parameter sets by using the EVP AEAD API variants.