Rewindex/CVEs/Amazon Web Services

CVE-2026-3336: PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

Description

Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · CWE-295

Tracked companies

Amazon Web Services

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

AWS: AWS-LCRed Hat: Confidential Compute AttestationRed Hat: Red Hat Enterprise Linux 10Red Hat: Red Hat Enterprise Linux 9Red Hat: Red Hat OpenShift Container Platform 4Red Hat: Red Hat OpenShift Update ServiceRed Hat: Red Hat Trusted Artifact Signer 1.3Red Hat: Red Hat Trusted Profile Analyzer

References

• CVE record on cve.org (opens in new tab)
• NVD entry (opens in new tab)
• aws.amazon.com/security/security-bulletins/2026-005-AWS/ (opens in new tab)
• github.com/aws/aws-lc/releases/tag/v1.69.0 (opens in new tab)
• github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp (opens in new tab)

All CVEsMarkdownJSON

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)