# CVE-2026-4428: RUSTSEC-2026-0048 - CRL Distribution Point Scope Check Logic Error in AWS-LC

Source: https://junglewise.ai/threats/cve-2026-4428-aws-aws-lc-revocation-check-bypass-in-x-509-certificate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-19. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-4428 · Severity: high · CVSS 3.1 · Published 2026-03-19

AWS-LC is a cryptographic library used by applications to secure communications and verify digital identities. A flaw in how the library checks certificate revocation lists (CRLs) could allow a revoked or invalid security certificate to be incorrectly accepted as valid. This could allow an attacker to impersonate a trusted service or user, potentially leading to unauthorized access or intercepted data.

Technologies: [Amazon AWS](https://junglewise.ai/threats/technologies/aws), [AWS-LC](https://junglewise.ai/threats/technologies/lc), [Aws-Lc-Sys](https://junglewise.ai/threats/technologies/aws-lc-sys), [aws-lc-sys (crates.io)](https://junglewise.ai/threats/technologies/crates-io-aws-lc-sys). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon), [AWS](https://junglewise.ai/threats/vendors/aws), [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-4428 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4428 being exploited in the wild.

**How severe is CVE-2026-4428?** High severity, with a CVSS score of 3.1, published 19 March 2026.

**Which products and versions are affected?** AWS-LC >= v1.24.0, < v1.71.0; AWS-LC-FIPS >= 3.0.0, < 3.3.0; Aws-Lc-Fips-Sys >= v0.13.0, < v0.13.13; Aws-Lc-Sys >= v0.15.0, < v0.39.0; and 2 more.

**Is there a fix for CVE-2026-4428?** Yes. aws-lc-fips-sys (crates.io): upgrade to 0.13.13 or later; aws-lc-sys (crates.io): upgrade to 0.39.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4428 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4428?** Check whether you run Amazon AWS, AWS-LC, AWS-LC-FIPS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- aws-lc-fips-sys (crates.io): upgrade to 0.13.13 or later

  ```sh
  cargo update -p aws-lc-fips-sys
  ```

- aws-lc-sys (crates.io): upgrade to 0.39.0 or later

  ```sh
  cargo update -p aws-lc-sys
  ```


## Technical details

A logic error exists in the CRL distribution point matching logic within AWS-LC's X.509 certificate verification component. When an application enables CRL checking (via X509_V_FLAG_CRL_CHECK) and processes partitioned CRLs containing Issuing Distribution Point (IDP) extensions, the library may fail to correctly scope the CRL to the certificate. This failure allows a revoked certificate to bypass the revocation check and be treated as valid. The vulnerability affects AWS-LC, its FIPS-compliant version, and associated Rust wrappers (aws-lc-sys). Users should update to AWS-LC v1.71.0, AWS-LC-FIPS v3.3.0, or the respective sys-crate updates.

## Affected products

- AWS AWS-LC >= v1.24.0, < v1.71.0
- AWS AWS-LC-FIPS >= 3.0.0, < 3.3.0
- AWS aws-lc-sys >= v0.15.0, < v0.39.0
- AWS aws-lc-fips-sys >= v0.13.0, < v0.13.13

## Identifiers

- CVE-2026-4428
- GHSA-9f94-5g5w-gf6r
- RUSTSEC-2026-0042
- RUSTSEC-2026-0048

## Timeline

- 2026-03-19: disclosed
- 2026-03-19: patched

## References

- [https://aws.amazon.com/security/security-bulletins/rss/2026-010-aws/](https://aws.amazon.com/security/security-bulletins/rss/2026-010-aws/)

## Related threats

- [An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0)](https://junglewise.ai/threats/cve-2026-126793-privilege-escalation-in-aurora-postgresql-dialect-detection-in)
- [AWS SDK for pandas EMR unverified bucket ownership](https://junglewise.ai/threats/cve-2026-127119-unverified-ownership-of-the-default-emr-cluster-log-location-in)
- [Amazon mcp-gateway-registry server-side request forgery in registration API](https://junglewise.ai/threats/cve-2026-125926-server-side-request-forgery-in-the-server-registration-and)
- [Amazon mcp-gateway-registry authorization bypass in management API](https://junglewise.ai/threats/cve-2026-100307-missing-authorization-on-the-external-management-api-in-mcp)
- [AWS Kiro CLI incorrect default permissions on session files](https://junglewise.ai/threats/cve-2026-124848-incorrect-default-permissions-on-session-transcripts-and-prompt)