AWS-LC <1.69: Unauth bypass in PKCS7_verify signature validation
CVE-2026-3338 Published on March 2, 2026

PKCS7_verify Signature Validation Bypass in AWS-LC
Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Github Repository Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-3338 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

Improper Verification of Cryptographic Signature

The software does not verify, or incorrectly verifies, the cryptographic signature for data.


Products Associated with CVE-2026-3338

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-3338 are published in these products:

Amazon Aws
 
Red Hat Trusted Artifact Signer
 
Red Hat Confidential Compute Attestation
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Openshift
 
Red Hat Trusted Profile Analyzer
 
Red Hat Openshift Update Service
 

Affected Versions

AWS-LC: Red Hat Trusted Artifact Signer 1.3: Red Hat Trusted Artifact Signer 1.3: Red Hat Confidential Compute Attestation: Red Hat Confidential Compute Attestation: Red Hat Confidential Compute Attestation: Red Hat Confidential Compute Attestation: Red Hat Confidential Compute Attestation: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 9: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Update Service: Red Hat Trusted Profile Analyzer:

Exploit Probability

EPSS
0.70%
Percentile
48.41%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.