# CVE-2026-3336: AWS AWS-LC certificate chain validation bypass in PKCS7_verify

Source: https://junglewise.ai/threats/cve-2026-3336-aws-aws-lc-certificate-chain-validation-bypass-in-pkcs7-verify  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-02. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-3336 · Severity: high · CVSS 7.5 · Published 2026-03-02

AWS-LC is a cryptographic library used by applications to secure data and verify digital signatures. A flaw in this library allows attackers to provide specially crafted files that appear to be legitimately signed even if they are not. This could allow an attacker to bypass security checks, potentially leading to the installation of malicious software or the acceptance of forged digital documents.

Technologies: [Amazon AWS](https://junglewise.ai/threats/technologies/aws), [AWS-LC](https://junglewise.ai/threats/technologies/lc), [Aws-Lc-Sys](https://junglewise.ai/threats/technologies/aws-lc-sys), [aws-lc-sys (crates.io)](https://junglewise.ai/threats/technologies/crates-io-aws-lc-sys), [Red Hat Trusted Artifact Signer](https://junglewise.ai/threats/technologies/trusted-artifact-signer). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon), [AWS](https://junglewise.ai/threats/vendors/aws), [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-3336 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3336 being exploited in the wild.

**How severe is CVE-2026-3336?** High severity, with a CVSS score of 7.5, published 2 March 2026.

**Which products and versions are affected?** AWS-LC >= v1.41.0, < v1.69.0; >= v1.21.0, < v1.69.0; >= AWS-LC-FIPS-3.0.0, < AWS-LC-FIPS-3.2.0; Aws-Lc-Sys >= v0.24.0, < v0.38.0; >= v0.14.0, < v0.38.0; Aws-Lc-Sys-Fips >= v0.13.0, < v0.13.12; aws-lc-sys (crates.io) SEMVER:introduced=0.24.0,fixed=0.38.0; and 1 more.

**Is there a fix for CVE-2026-3336?** Yes. aws-lc-sys (crates.io): upgrade to 0.38.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3336 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-3336?** Check whether you run Amazon AWS, Amazon Aws Libcrypto, AWS-LC or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- aws-lc-sys (crates.io): upgrade to 0.38.0 or later

  ```sh
  cargo update -p aws-lc-sys
  ```


## Technical details

A vulnerability exists in the PKCS7_verify() function of the AWS-LC cryptographic library due to improper certificate validation. When processing PKCS7 objects containing multiple signers, the library fails to verify the certificate chains for all signers except the final one. A remote, unauthenticated attacker can exploit this by crafting a PKCS7 object with multiple signers where intermediate signers have invalid or untrusted chains, effectively bypassing intended security identity checks. The issue is resolved in AWS-LC version 1.69.0 and aws-lc-sys version 0.38.0.

## Affected products

- AWS AWS-LC >= v1.41.0, < v1.69.0
- AWS aws-lc-sys >= v0.24.0, < v0.38.0
- Red Hat Red Hat Trusted Artifact Signer 1.3
- Red Hat Red Hat Enterprise Linux 9, 10
- Red Hat Red Hat OpenShift Container Platform 4

## Identifiers

- CVE-2026-3336
- CVE-2026-3338
- CVE-2026-3337
- GHSA-vw5v-4f2q-w9xf
- RUSTSEC-2026-0046

## Timeline

- 2026-03-02: advisory: Initial advisory published by AWS and GitHub Security Advisory created.
- 2026-03-02: patched: AWS-LC v1.69.0 released.
- 2026-03-23: advisory: Red Hat published security advisory RHSA-2026:5459.

## References

- [https://aws.amazon.com/security/security-bulletins/2026-005-AWS/](https://aws.amazon.com/security/security-bulletins/2026-005-AWS/)
- [https://github.com/aws/aws-lc/releases/tag/v1.69.0](https://github.com/aws/aws-lc/releases/tag/v1.69.0)
- [https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp](https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp)
- [https://access.redhat.com/errata/RHSA-2026:5459](https://access.redhat.com/errata/RHSA-2026:5459)
- [https://access.redhat.com/security/cve/CVE-2026-3336](https://access.redhat.com/security/cve/CVE-2026-3336)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2444026](https://bugzilla.redhat.com/show_bug.cgi?id=2444026)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3336.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3336.json)

## Related threats

- [An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0)](https://junglewise.ai/threats/cve-2026-126793-privilege-escalation-in-aurora-postgresql-dialect-detection-in)
- [AWS SDK for pandas EMR unverified bucket ownership](https://junglewise.ai/threats/cve-2026-127119-unverified-ownership-of-the-default-emr-cluster-log-location-in)
- [Amazon mcp-gateway-registry server-side request forgery in registration API](https://junglewise.ai/threats/cve-2026-125926-server-side-request-forgery-in-the-server-registration-and)
- [Amazon mcp-gateway-registry authorization bypass in management API](https://junglewise.ai/threats/cve-2026-100307-missing-authorization-on-the-external-management-api-in-mcp)
- [AWS Kiro CLI incorrect default permissions on session files](https://junglewise.ai/threats/cve-2026-124848-incorrect-default-permissions-on-session-transcripts-and-prompt)