Vulnerability details
CVE-2026-3336
AWS AWS-LCRed Hat Confidential Compute AttestationRed Hat Enterprise Linux 10Red Hat Enterprise Linux 9Red Hat OpenShift Container Platform 4Red Hat Trusted Profile Analyzer
PKCS7_verify Certificate Chain Validation Bypass in AWS-LC
CVSS 4.0
8.7High
Official description
Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 4.0 | CVEProject cvelistV5 (CNA) (AMZN) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (AMZN) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| AWS | AWS-LC | 1.41.0 ≤ v < 1.69.0 | CVEProject cvelistV5 (CNA) |
| Red Hat | Confidential Compute Attestation | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 10 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 10 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 9 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Trusted Profile Analyzer | All | CVEProject cvelistV5 (CNA) |
References and advisories
7- https://aws.amazon.com/security/security-bulletins/2026-005-AWS/ vendor-advisory
- https://github.com/aws/aws-lc/releases/tag/v1.69.0 patch
- https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp third-party-advisory
- https://access.redhat.com/security/cve/CVE-2026-3336 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2444026 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3336.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:5459 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-03
- Last updated
- 2026-08-21
- State
- Published
- Assigner (CNA)
- AMZN
Exploit prediction (EPSS)
0.73%
Probability of exploitation in 30 days
54.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-295(Improper Certificate Validation)