# CVE-2026-3338: AWS AWS-LC signature verification bypass in PKCS7_verify

Source: https://junglewise.ai/threats/cve-2026-3338-aws-aws-lc-signature-verification-bypass-in-pkcs7-verify  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-02. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-3338 · Severity: high · CVSS 7.5 · Published 2026-03-02

AWS-LC is a cryptographic library used by applications to secure data and verify digital signatures. A flaw in this library allows an attacker to bypass signature verification when processing certain types of signed objects. This could allow unauthorized or malicious data to be accepted as authentic, potentially leading to the execution of untrusted code or the acceptance of forged documents.

Technologies: [aws-lc-sys (crates.io)](https://junglewise.ai/threats/technologies/crates-io-aws-lc-sys), [Red Hat Trusted Artifact Signer](https://junglewise.ai/threats/technologies/trusted-artifact-signer). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon), [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-3338 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3338 being exploited in the wild.

**How severe is CVE-2026-3338?** High severity, with a CVSS score of 7.5, published 2 March 2026.

**Which products and versions are affected?** aws-lc-sys (crates.io) SEMVER:introduced=0.24.0,fixed=0.38.0; Red Hat Trusted Artifact Signer 1.3.

**Is there a fix for CVE-2026-3338?** Yes. aws-lc-sys (crates.io): upgrade to 0.38.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3338 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-3338?** Check whether you run Amazon Aws Libcrypto, aws-lc-sys (crates.io) or Red Hat Trusted Artifact Signer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- aws-lc-sys (crates.io): upgrade to 0.38.0 or later

  ```sh
  cargo update -p aws-lc-sys
  ```


## Technical details

A vulnerability exists in AWS-LC's PKCS7_verify() function due to improper validation of cryptographic signatures when processing PKCS7 objects that include Authenticated Attributes. An unauthenticated remote attacker can exploit this by providing a specially crafted PKCS7 object, causing the library to incorrectly report a successful signature verification. This bypasses the integrity protections intended by the PKCS7 standard. The issue is rooted in how the library handles the transition or comparison of attributes during the verification process. The vulnerability is addressed in AWS-LC version 1.69.0 and aws-lc-sys version 0.38.0.

## Affected products

- AWS AWS-LC >= 1.41.0, < 1.69.0
- AWS aws-lc-sys >= 0.24.0, < 0.38.0
- Red Hat Red Hat Trusted Artifact Signer 1.3
- Red Hat Red Hat Enterprise Linux 9, 10

## Identifiers

- CVE-2026-3338
- GHSA-hfpc-8r3f-gw53
- RUSTSEC-2026-0047

## Timeline

- 2026-03-02: advisory: Initial advisory published by AWS and GitHub Security Advisory issued.
- 2026-03-02: patched: AWS-LC version 1.69.0 released.
- 2026-03-23: advisory: Red Hat published security advisory RHSA-2026:5459.

## References

- [https://aws.amazon.com/security/security-bulletins/2026-005-AWS/](https://aws.amazon.com/security/security-bulletins/2026-005-AWS/)
- [https://github.com/aws/aws-lc/releases/tag/v1.69.0](https://github.com/aws/aws-lc/releases/tag/v1.69.0)
- [https://github.com/aws/aws-lc/security/advisories/GHSA-jchq-39cv-q4wj](https://github.com/aws/aws-lc/security/advisories/GHSA-jchq-39cv-q4wj)
- [https://access.redhat.com/errata/RHSA-2026:5459](https://access.redhat.com/errata/RHSA-2026:5459)
- [https://access.redhat.com/security/cve/CVE-2026-3338](https://access.redhat.com/security/cve/CVE-2026-3338)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2444025](https://bugzilla.redhat.com/show_bug.cgi?id=2444025)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3338.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3338.json)

## Related threats

- [HashiCorp go-getter arbitrary file read via argument injection in Git URLs](https://junglewise.ai/threats/cve-2026-4660-hashicorp-go-getter-arbitrary-file-read-via-argument-injection-in)
- [path-to-regexp denial of service via sequential optional groups](https://junglewise.ai/threats/cve-2026-4926-path-to-regexp-denial-of-service-via-sequential-optional-groups)
- [AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN](https://junglewise.ai/threats/aws-lc-x-509-name-constraints-bypass-via-wildcard-unicode-cn-3aa77348)
- [RUSTSEC-2026-0044 - AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN](https://junglewise.ai/threats/rustsec-2026-0044-aws-lc-x-509-name-constraints-bypass-via-wildcard-64993ed0)
- [RUSTSEC-2026-0048 - CRL Distribution Point Scope Check Logic Error in AWS-LC](https://junglewise.ai/threats/cve-2026-4428-aws-aws-lc-revocation-check-bypass-in-x-509-certificate)