CVE-2026-4428: RUSTSEC-2026-0048 - CRL Distribution Point Scope Check Logic Error in AWS-LC

CVE-2026-4428 · Severity: high · CVSS 3.1 · Published 2026-03-19

AWS-LC is a cryptographic library used by applications to secure communications and verify digital identities. A flaw in how the library checks certificate revocation lists (CRLs) could allow a revoked or invalid security certificate to be incorrectly accepted as valid. This could allow an attacker to impersonate a trusted service or user, potentially leading to unauthorized access or intercepted data.

Technologies: Amazon AWS, AWS-LC, Aws-Lc-Sys, aws-lc-sys (crates.io). Vendors: Amazon, AWS, crates.io.

Quick answers

Is CVE-2026-4428 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4428 being exploited in the wild.
How severe is CVE-2026-4428?
High severity, with a CVSS score of 3.1, published 19 March 2026.
Which products and versions are affected?
AWS-LC >= v1.24.0, < v1.71.0; AWS-LC-FIPS >= 3.0.0, < 3.3.0; Aws-Lc-Fips-Sys >= v0.13.0, < v0.13.13; Aws-Lc-Sys >= v0.15.0, < v0.39.0; and 2 more.
Is there a fix for CVE-2026-4428?
Yes. aws-lc-fips-sys (crates.io): upgrade to 0.13.13 or later; aws-lc-sys (crates.io): upgrade to 0.39.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4428 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-4428?
Check whether you run Amazon AWS, AWS-LC, AWS-LC-FIPS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • aws-lc-fips-sys (crates.io): upgrade to 0.13.13 or later
    cargo update -p aws-lc-fips-sys
  • aws-lc-sys (crates.io): upgrade to 0.39.0 or later
    cargo update -p aws-lc-sys

Technical details

A logic error exists in the CRL distribution point matching logic within AWS-LC's X.509 certificate verification component. When an application enables CRL checking (via X509_V_FLAG_CRL_CHECK) and processes partitioned CRLs containing Issuing Distribution Point (IDP) extensions, the library may fail to correctly scope the CRL to the certificate. This failure allows a revoked certificate to bypass the revocation check and be treated as valid. The vulnerability affects AWS-LC, its FIPS-compliant version, and associated Rust wrappers (aws-lc-sys). Users should update to AWS-LC v1.71.0, AWS-LC-FIPS v3.3.0, or the respective sys-crate updates.

Affected products

  • AWS AWS-LC >= v1.24.0, < v1.71.0
  • AWS AWS-LC-FIPS >= 3.0.0, < 3.3.0
  • AWS aws-lc-sys >= v0.15.0, < v0.39.0
  • AWS aws-lc-fips-sys >= v0.13.0, < v0.13.13

Identifiers

  • CVE-2026-4428
  • GHSA-9f94-5g5w-gf6r
  • RUSTSEC-2026-0042
  • RUSTSEC-2026-0048

Timeline

  • 2026-03-19: disclosed
  • 2026-03-19: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.