ZeroDay Findings
Sign inSign up

Findings

CVE-2026-3338

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authentica…

Published Mar 2, 2026 · updated Jul 15, 2026 · amazon aws-lc-sys

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 2, 2026 · NIST NVD

    Detected

    Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

  2. Jul 15, 2026 · NIST NVD

    Updated

    Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Affected

  • cpe amazon/aws libcryptoversion unspecified
  • cpe amazon/aws-lc-sysversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-3338

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-3338

    Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade

    nvd.nist.gov

References