CVE-2026-4428

CRL Distribution Point Scope Check Logic Error in AWS-LC

CVSS 3.1 7.4 HIGHCVSS 4.0 9.1 CRITICALEUVD CVSS 4.0 9.1 CVSS 4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 9.1 CRITICALCVSS 3.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 7.4 HIGHCVSS_V3 Publisher rating HIGHFixed by aws-lc-fips-sys 0.13.13 Fixed by aws-lc-sys 0.39.0CVSS_V3 Fixed by aws-lc-fips-sys 0.13.13CVSS_V3 Fixed by aws-lc-sys 0.39.0KEV status unknown

Original advisory

cve-program · CVE-2026-4428

Published

A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should upgrade to AWS-LC 1.71.0 or AWS-LC-FIPS-3.3.0.

Read the publisher's advisory

euvd · EUVD-2026-13237

Published

Read the publisher's advisory

nvd · CVE-2026-4428

Published

Read the publisher's advisory

osv · GHSA-9f94-5g5w-gf6r

Published

### Summary AWS-LC is an open-source, general-purpose cryptographic library. ### Impact A logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ### Impacted versions: * aws-lc-sys >= v0.15.0, < v0.39.0 * aws-lc-fips-sys >= v0.13.0, < v0.13.13 ### Patches The patch is included in aws-lc-sys v0.39.0 and aws-lc-fips-sys v0.13.13. ### Workarounds Applications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ### References If you have any questions or comments about this advisory, we ask that you contact AWS Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [[email protected]](mailto:[email protected]). Please do not create a public GitHub issue.

Read the publisher's advisory

osv · RUSTSEC-2026-0042

Published

A logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. `aws-lc-fips-sys` contains code from AWS-LC. Applications using `aws-lc-fips-sys` should upgrade to the most recent release of `aws-lc-fips-sys`. ## Workarounds Applications can workaround this issue if they do not enable CRL checking (`X509_V_FLAG_CRL_CHECK`). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using `aws-lc-fips-sys` should upgrade to the most recent releases of `aws-lc-fips-sys`.

Read the publisher's advisory

osv · RUSTSEC-2026-0048

Published

A logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. `aws-lc-sys` contains code from AWS-LC. Applications using `aws-lc-sys` should upgrade to the most recent release of `aws-lc-sys`. ## Workarounds Applications can workaround this issue if they do not enable CRL checking (`X509_V_FLAG_CRL_CHECK`). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using `aws-lc-sys` should upgrade to the most recent releases of `aws-lc-sys`.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-4428

Published

AWS-LC

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "AWS",
                    "product": "AWS-LC",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.24.0",
                            "lessThan": "1.71.0",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

AWS-LC-FIPS

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "AWS",
                    "product": "AWS-LC-FIPS",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "3.0.0",
                            "lessThan": "3.3.0",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-13237

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Mar 19, 2026, 8:37:53 PM

dateUpdated: Mar 25, 2026, 2:13:42 PM

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-4428

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Awaiting Analysis

Weakness classifications: CWE-299

Original publisher date fields

published: 2026-03-19T21:17:14.170

lastModified: 2026-06-17T10:56:33.390

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-9f94-5g5w-gf6r

Published

aws-lc-fips-sys

crates.io

SEMVER · introduced 0.13.0 → fixed 0.13.13

aws-lc-sys

crates.io

SEMVER · introduced 0.15.0 → fixed 0.39.0

Original source record · Cite this exact observation · Complete original publisher JSON

osv · RUSTSEC-2026-0042

Published

aws-lc-fips-sys

crates.io

SEMVER · introduced 0.13.0 → fixed 0.13.13

Original source record · Cite this exact observation · Complete original publisher JSON

osv · RUSTSEC-2026-0048

Published

aws-lc-sys

crates.io

SEMVER · introduced 0.15.0 → fixed 0.39.0

Original source record · Cite this exact observation · Complete original publisher JSON