Threats tagged 'rustsec-2026-0046'

CVE-2026-3336 is a vulnerability in the AWS-LC cryptographic library's PKCS7_verify() function that allows unauthenticated users to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. This flaw affects aws-lc-sys versions from 0.24.0 up to but not including 0.38.0. The issue has been fixed in version 0.38.0. There is no workaround; users should upgrade to the latest release to mitigate this vulnerability. Customers using AWS cloud services are not required to take action as the vendor manages remediation for those services.