CVE-2026-3336CWE-295

PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

High · published March 2, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
32.6
In the wild
Unconfirmed
What it is

Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.

Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00395 · 32.6th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-03-02T21:15Z
EPSS history
Timeline
  • 02 MAR 21:15Z
    PKCS7_verify Certificate Chain Validation Bypass in AWS-LC
    cvelistv5