AWS-LC vulnerabilities

3 known vulnerabilities in AWS-LC from AWS. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  AWS-LC: Improper Check for Certificate Revocation

  CVE-2026-4428Mar 19, 2026AWS

  A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should upg

• 7.5 High severity

  AWS-LC: Improper Verification of Cryptographic Signature

  CVE-2026-3338Mar 2, 2026AWS

  Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-

• 7.5 High severity

  AWS-LC: Improper Certificate Validation

  CVE-2026-3336Mar 2, 2026AWS

  Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take acti