CVE-2026-4428 CRL Distribution Point Scope Check Logic Error in AWS-LC
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-4428?
CVE-2026-4428 is a critical vulnerability in AWS-LC, published on 19 Mar 2026.
Official description
A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks.
To remediate this issue, users should upgrade to AWS-LC 1.71.0 or AWS-LC-FIPS-3.3.0.
Weakness: CWE-299
Which versions are affected by CVE-2026-4428?
6 open source packages ship an affected version, including aws-lc-fips-sys and aws-lc-sys.
| Package | Affected | Fixed in |
|---|---|---|
aws-lc-fips-sys crates.io | From 0.13.0 | 0.13.13 |
aws-lc-fips-sys crates.io | From 0.13.0 | 0.13.13 |
aws-lc-fips-sys crates.io | From 0.13.0 | 0.13.13 |
aws-lc-sys crates.io | From 0.15.0 | 0.39.0 |
aws-lc-sys crates.io | From 0.15.0 | 0.39.0 |
aws-lc-sys crates.io | From 0.15.0 | 0.39.0 |
How do I fix CVE-2026-4428?
Upgrade aws-lc-fips-sys to 0.13.13 or later.
Is CVE-2026-4428 being exploited?
There is no known exploitation of CVE-2026-4428 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-CP29339, CLEANSTART-2026-KO91449, GHSA-9f94-5g5w-gf6r, MINI-2mxc-x544-36px, MINI-37cj-564v-w58g, MINI-3rr3-crv7-vp34 and 15 more.