Aws-lc-sys (Amazon) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 65 known versions, newest CVE from 2026-03-02. Vendor: Amazon.

CVEs of Aws-lc-sys

• CVE-2026-3338 - CVSS 8.7 (high), 2026-03-02: Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with…
• CVE-2026-3337 - CVSS 8.2 (high), 2026-03-02: Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing…
• CVE-2026-3336 - CVSS 8.7 (high), 2026-03-02: Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7…