CVE-2026-3336

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-3336
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3336.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-3336
Aliases
Published
2026-03-02T21:15:16.709Z
Modified
2026-07-16T03:48:28.822031634Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
PKCS7_verify Certificate Chain Validation Bypass in AWS-LC
Details

Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.

Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Database specific 
{
    "cwe_ids": [
        "CWE-295"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3336.json",
    "cna_assigner": "AMZN"
}
References

Affected packages

Git / github.com/aws/aws-lc

Affected ranges

Type
GIT
Repo
https://github.com/aws/aws-lc
Events
Introduced
dd5948b5a55f5dc5f0db9bbfa0e21c35d9e820e2
Fixed
37d86461a95782fd5d8b77873f9e1cb134ea2f95
Database specific 
{
    "cpe": "cpe:2.3:a:amazon:aws_libcrypto:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.41.0"
        },
        {
            "fixed": "1.69.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

AWS-LC-FIPS-NETOS-v1.*
AWS-LC-FIPS-NETOS-v1.29.1
v1.*
v1.41.0
v1.41.1
v1.42.0
v1.43.0
v1.44.0
v1.45.0
v1.46.0
v1.46.1
v1.47.0
v1.48.0
v1.48.1
v1.48.2
v1.48.3
v1.48.4
v1.48.5
v1.49.0
v1.49.1
v1.50.0
v1.50.1
v1.51.0
v1.51.1
v1.51.2
v1.52.0
v1.52.1
v1.53.0
v1.53.1
v1.54.0
v1.55.0
v1.56.0
v1.57.0
v1.57.1
v1.58.0
v1.58.1
v1.59.0
v1.60.0
v1.61.0
v1.61.1
v1.61.2
v1.61.3
v1.61.4
v1.62.0
v1.62.1
v1.63.0
v1.64.0
v1.65.0
v1.65.1
v1.66.0
v1.66.1
v1.66.2
v1.67.0
v1.68.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3336.json"