Executive brief
AWS-LC is a cryptographic library used by applications to secure communications and verify digital identities. A flaw in how the library checks certificate revocation lists (CRLs) could allow a revoked or invalid security certificate to be incorrectly accepted as valid. This could allow an attacker to impersonate a trusted service or user, potentially leading to unauthorized access or intercepted data.
Technical details
A logic error exists in the CRL distribution point matching logic within AWS-LC's X.509 certificate verification component. When an application enables CRL checking (via X509_V_FLAG_CRL_CHECK) and processes partitioned CRLs containing Issuing Distribution Point (IDP) extensions, the library may fail to correctly scope the CRL to the certificate. This failure allows a revoked certificate to bypass the revocation check and be treated as valid. The vulnerability affects AWS-LC, its FIPS-compliant version, and associated Rust wrappers (aws-lc-sys). Users should update to AWS-LC v1.71.0, AWS-LC-FIPS v3.3.0, or the respective sys-crate updates.
Affected products
- AWS AWS-LC >= v1.24.0, < v1.71.0
- AWS AWS-LC-FIPS >= 3.0.0, < 3.3.0
- AWS aws-lc-sys >= v0.15.0, < v0.39.0
- AWS aws-lc-fips-sys >= v0.13.0, < v0.13.13
Timeline
- 2026-03-19: disclosed
- 2026-03-19: patched