CVE-2026-3338 PKCS7_verify Signature Validation Bypass in AWS-LC
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-3338?
CVE-2026-3338 is a high-severity vulnerability in AWS-LC, published on 2 Mar 2026.
Official description
Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes.
Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Weakness: CWE-347
Which versions are affected by CVE-2026-3338?
3 open source packages ship an affected version, including aws-lc-sys. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
aws-lc-sys crates.io | From 0.24.0 | 0.38.0 |
aws-lc-sys crates.io | From 0.24.0 | 0.38.0 |
aws-lc-sys crates.io | From 0.24.0 | 0.38.0 |
Products include Amazon Aws-Lc-Sys, Amazon Aws Libcrypto.
How do I fix CVE-2026-3338?
Upgrade aws-lc-sys to 0.38.0 or later.
Is CVE-2026-3338 being exploited?
There is no known exploitation of CVE-2026-3338 in the wild and no public exploit code.
Other vulnerabilities in AWS-LC
Sources
Also known as CLEANSTART-2026-EL62572, GHSA-hfpc-8r3f-gw53, GHSA-jchq-39cv-q4wj, MINI-32hc-wxwp-7qg5, MINI-3396-3g4c-w9pw, MINI-59ph-56vg-f4gr and 14 more.