CVE-2026-3336

High

Open

TLP:CLEAR

PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Details

CVSS Score: 7.5
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Confidence: 90%
Published: Mar 2, 2026
Last Modified: Aug 21, 2026

Notes

0

Log in to add a note

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

0

Log in to add an opinion

No opinions yet. Be the first to assess this intelligence.