CVE-2026-3337

Timing Side-Channel in AES-CCM Tag Verification in AWS-LC

CVSS 3.1 5.9 MEDIUMCVSS 4.0 8.2 HIGHEUVD CVSS 4.0 8.2 CVSS 4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 8.2 HIGHCVSS 3.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 5.9 MEDIUMCVSS_V3 CVSS_V4 Publisher rating HIGHFixed by aws-lc-sys 0.38.0 Fixed by aws-lc-fips-sys 0.13.12CVSS_V3 Fixed by aws-lc-fips-sys 0.13.12CVSS_V3 Fixed by aws-lc-sys 0.38.0KEV status unknown

Original advisory

cve-program · CVE-2026-3337

Published

Read the publisher's advisory

euvd · EUVD-2026-9265

Published

Read the publisher's advisory

nvd · CVE-2026-3337

Published

Read the publisher's advisory

osv · GHSA-65p9-r9h6-22vj

Published

### Summary AWS-LC is an open-source, general-purpose cryptographic library. ### Impact Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ### Impacted versions: - aws-lc-sys versions: >= 0.14.0, < 0.38.0 - aws-lc-fips-sys versions: >= v0.13.0, < 0.13.12. ### Patches The patch is included in aws-lc-sys v.0.38.0 and aws-lc-fips-sys v0.13.12. ### Workarounds In the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations EVP_aead_aes_128_ccm_bluetooth, EVP_aead_aes_128_ccm_bluetooth_8, and, EVP_aead_aes_128_ccm_matter respectively. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ### Resources If there are any questions or comments about this advisory, contact [AWS/Amazon] Security via the[vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [[email protected]](mailto:[email protected]). Please do not create a public GitHub issue. ### Acknowledgement AWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process.

Read the publisher's advisory

osv · RUSTSEC-2026-0043

Published

Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: `EVP_aes_128_ccm`, `EVP_aes_192_ccm`, and `EVP_aes_256_ccm`. Customers of AWS services do not need to take action. `aws-lc-fips-sys` contains code from AWS-LC. Applications using `aws-lc-fips-sys` should upgrade to the most recent release of `aws-lc-fips-sys`. ## Workarounds In the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations `EVP_aead_aes_128_ccm_bluetooth`, `EVP_aead_aes_128_ccm_bluetooth_8`, and `EVP_aead_aes_128_ccm_matter` respectively. Otherwise, there is no workaround and applications using `aws-lc-fips-sys` should upgrade to the most recent release of `aws-lc-fips-sys`.

Read the publisher's advisory

osv · RUSTSEC-2026-0045

Published

Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: `EVP_aes_128_ccm`, `EVP_aes_192_ccm`, and `EVP_aes_256_ccm`. Customers of AWS services do not need to take action. `aws-lc-sys` contains code from AWS-LC. Applications using `aws-lc-sys` should upgrade to the most recent release of `aws-lc-sys`. ## Workarounds In the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations `EVP_aead_aes_128_ccm_bluetooth`, `EVP_aead_aes_128_ccm_bluetooth_8`, and `EVP_aead_aes_128_ccm_matter` respectively. Otherwise, there is no workaround and applications using `aws-lc-sys` should upgrade to the most recent release.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-3337

Published

AWS-LC

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "AWS-LC",
                    "vendor": "AWS",
                    "versions": [
                        {
                            "lessThan": "1.69.0",
                            "status": "affected",
                            "version": "1.21.0",
                            "versionType": "custom"
                        }
                    ]
                }

AWS-LC-FIPS

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "AWS-LC-FIPS",
                    "vendor": "AWS",
                    "versions": [
                        {
                            "lessThan": "3.2.0",
                            "status": "affected",
                            "version": "3.0.0",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-9265

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Mar 2, 2026, 9:20:08 PM

dateUpdated: Mar 3, 2026, 8:04:27 PM

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-3337

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-208

Original publisher date fields

published: 2026-03-02T22:16:32.093

lastModified: 2026-06-17T10:43:25.807

4 source CPE criteria · context only

cpe:2.3:a:amazon:aws-lc-fips-sys:*:*:*:*:*:rust:*:*
cpe:2.3:a:amazon:aws-lc-sys:*:*:*:*:*:rust:*:*
cpe:2.3:a:amazon:aws_libcrypto:*:*:*:*:*:*:*:*
cpe:2.3:a:amazon:aws_libcrypto:*:*:*:*:fips:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-65p9-r9h6-22vj

Published

aws-lc-sys

crates.io

SEMVER · introduced 0.14.0 → fixed 0.38.0

aws-lc-fips-sys

crates.io

SEMVER · introduced 0.13.0 → fixed 0.13.12

Original source record · Cite this exact observation · Complete original publisher JSON

osv · RUSTSEC-2026-0043

Published

aws-lc-fips-sys

crates.io

SEMVER · introduced 0.13.0 → fixed 0.13.12

Original source record · Cite this exact observation · Complete original publisher JSON

osv · RUSTSEC-2026-0045

Published

aws-lc-sys

crates.io

SEMVER · introduced 0.14.0 → fixed 0.38.0

Original source record · Cite this exact observation · Complete original publisher JSON