Amazon Aws-Lc-Sys vulnerabilities

3 CVEs affecting Amazon Aws-Lc-Sys, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-3338, published 2026-03-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-3337, published 2026-03-02. Medium severity, CVSS 5.9. EPSS: 0.5% chance of exploitation in the next 30 days. Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations…
CVE-2026-3338, published 2026-03-02. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of…
CVE-2026-3336, published 2026-03-02. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the…