Is CVE-2026-3338 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3338 being exploited in the wild.

How severe is CVE-2026-3338?

High severity, with a CVSS score of 7.5, published 2 March 2026.

Which products and versions are affected?

aws-lc-sys (crates.io) SEMVER:introduced=0.24.0,fixed=0.38.0; Red Hat Trusted Artifact Signer 1.3.

Is there a fix for CVE-2026-3338?

Yes. aws-lc-sys (crates.io): upgrade to 0.38.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3338 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-3338?

Check whether you run Amazon Aws Libcrypto, aws-lc-sys (crates.io) or Red Hat Trusted Artifact Signer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3338: AWS AWS-LC signature verification bypass in PKCS7_verify

CVE-2026-3338 · Severity: high · CVSS 7.5 · Published 2026-03-02

AWS-LC is a cryptographic library used by applications to secure data and verify digital signatures. A flaw in this library allows an attacker to bypass signature verification when processing certain types of signed objects. This could allow unauthorized or malicious data to be accepted as authentic, potentially leading to the execution of untrusted code or the acceptance of forged documents.

Technologies: aws-lc-sys (crates.io), Red Hat Trusted Artifact Signer. Vendors: Amazon, crates.io, Red Hat.

Quick answers

Is CVE-2026-3338 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3338 being exploited in the wild.
How severe is CVE-2026-3338?: High severity, with a CVSS score of 7.5, published 2 March 2026.
Which products and versions are affected?: aws-lc-sys (crates.io) SEMVER:introduced=0.24.0,fixed=0.38.0; Red Hat Trusted Artifact Signer 1.3.
Is there a fix for CVE-2026-3338?: Yes. aws-lc-sys (crates.io): upgrade to 0.38.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3338 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-3338?: Check whether you run Amazon Aws Libcrypto, aws-lc-sys (crates.io) or Red Hat Trusted Artifact Signer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

aws-lc-sys (crates.io): upgrade to 0.38.0 or later
```
cargo update -p aws-lc-sys
```

Technical details

A vulnerability exists in AWS-LC's PKCS7_verify() function due to improper validation of cryptographic signatures when processing PKCS7 objects that include Authenticated Attributes. An unauthenticated remote attacker can exploit this by providing a specially crafted PKCS7 object, causing the library to incorrectly report a successful signature verification. This bypasses the integrity protections intended by the PKCS7 standard. The issue is rooted in how the library handles the transition or comparison of attributes during the verification process. The vulnerability is addressed in AWS-LC version 1.69.0 and aws-lc-sys version 0.38.0.

Affected products

AWS AWS-LC >= 1.41.0, < 1.69.0
AWS aws-lc-sys >= 0.24.0, < 0.38.0
Red Hat Red Hat Trusted Artifact Signer 1.3
Red Hat Red Hat Enterprise Linux 9, 10

Identifiers

CVE-2026-3338
GHSA-hfpc-8r3f-gw53
RUSTSEC-2026-0047

Timeline

2026-03-02: advisory: Initial advisory published by AWS and GitHub Security Advisory issued.
2026-03-02: patched: AWS-LC version 1.69.0 released.
2026-03-23: advisory: Red Hat published security advisory RHSA-2026:5459.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.