No access to your tenant or devices. Every item links to its source. What this means
A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should upgrade to AWS-LC 1.71.0 or AWS-LC-FIPS-3.3.0.
Read the publisher's advisoryA logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should upgrade to AWS-LC 1.71.0 or AWS-LC-FIPS-3.3.0.
Read the publisher's advisoryA logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should upgrade to AWS-LC 1.71.0 or AWS-LC-FIPS-3.3.0.
Read the publisher's advisory### Summary AWS-LC is an open-source, general-purpose cryptographic library. ### Impact A logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ### Impacted versions: * aws-lc-sys >= v0.15.0, < v0.39.0 * aws-lc-fips-sys >= v0.13.0, < v0.13.13 ### Patches The patch is included in aws-lc-sys v0.39.0 and aws-lc-fips-sys v0.13.13. ### Workarounds Applications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ### References If you have any questions or comments about this advisory, we ask that you contact AWS Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [[email protected]](mailto:[email protected]). Please do not create a public GitHub issue.
Read the publisher's advisoryA logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. `aws-lc-fips-sys` contains code from AWS-LC. Applications using `aws-lc-fips-sys` should upgrade to the most recent release of `aws-lc-fips-sys`. ## Workarounds Applications can workaround this issue if they do not enable CRL checking (`X509_V_FLAG_CRL_CHECK`). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using `aws-lc-fips-sys` should upgrade to the most recent releases of `aws-lc-fips-sys`.
Read the publisher's advisoryA logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. `aws-lc-sys` contains code from AWS-LC. Applications using `aws-lc-sys` should upgrade to the most recent release of `aws-lc-sys`. ## Workarounds Applications can workaround this issue if they do not enable CRL checking (`X509_V_FLAG_CRL_CHECK`). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using `aws-lc-sys` should upgrade to the most recent releases of `aws-lc-sys`.
Read the publisher's advisoryCISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
Compare earlier KEV listings and daily EPSS scores. Advisory wording and affected versions have a separate history.
A prediction change is reported when EPSS rises from below 10% to 10% or higher. Other daily score changes remain in this history.
See how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.
Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.
euvd · EUVD-2026-13237 · Published
euvd · EUVD-2026-13237 · Published
osv · RUSTSEC-2026-0042 · Published
osv · RUSTSEC-2026-0048 · Published
euvd · EUVD-2026-13237 · Published
euvd · EUVD-2026-13237 · Published
euvd · EUVD-2026-13237 · Published
euvd · EUVD-2026-13237 · Published
euvd · EUVD-2026-13237 · Published
euvd · EUVD-2026-13237 · Published
euvd · EUVD-2026-13237 · Published
nvd · CVE-2026-4428 · Published
osv · GHSA-9f94-5g5w-gf6r · Published
osv · RUSTSEC-2026-0042 · Published
osv · RUSTSEC-2026-0048 · Published
cve-program · CVE-2026-4428 · Published