CVE-2026-4428CWE-299

CRL Distribution Point Scope Check Logic Error in AWS-LC

Critical · published March 19, 2026

CVSS v4.0
9.1
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks.

To remediate this issue, users should upgrade to AWS-LC 1.71.0 or AWS-LC-FIPS-3.3.0.

The record
Technical detail
CVSS v4.0
9.1 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00268 · 17.9th percentile
Weakness
CWE-299 · Improper Check for Certificate Revocation
Published
2026-03-19T20:37Z
EPSS history
Timeline
  • 19 MAR 20:37Z
    CRL Distribution Point Scope Check Logic Error in AWS-LC
    cvelistv5