CVE-2026-3336: 
Rust vulnerability analysis and mitigation

CVE-2026-3336 is a PKCS7_verify Certificate Chain Validation Bypass vulnerability in AWS-LC (Amazon's open-source cryptographic library) that allows an unauthenticated attacker to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. It was disclosed on March 2, 2026, as part of AWS Security Bulletin 2026-005-AWS, which also covered two related issues (CVE-2026-3337 and CVE-2026-3338). Affected versions are AWS-LC v1.41.0 through v1.68.x and aws-lc-sys (Rust bindings) v0.24.0 through v0.37.x; IBM API Connect is also listed as an affected downstream product. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (AWS Bulletin, GitHub Advisory).

The root cause is improper certificate validation (CWE-295) within the PKCS7_verify() function in AWS-LC. When a PKCS7 object contains multiple signers, the library failed to verify the certificate chains of all signers except the last one, meaning any intermediate signer's certificate could be untrusted or forged without triggering a validation error. The fix, introduced in v1.69.0, ensures all signer certificate chains are verified via the commit "Ensure all signer certificate chains are verified" by @torben-hansen. The vulnerability is exploitable remotely with no authentication, no privileges, and no user interaction required, making it trivially weaponizable against any application that processes multi-signer PKCS7 data using the affected library versions (GitHub Advisory, AWS-LC v1.69.0 Release, Red Hat Bugzilla).

Successful exploitation allows an unauthenticated attacker to bypass certificate chain validation for all but the final signer in a multi-signer PKCS7 object, enabling acceptance of forged or invalid certificates. This primarily impacts integrity — attackers could forge digital signatures, conduct man-in-the-middle attacks, or present maliciously crafted signed content that appears legitimate to the verifying application. There is no direct confidentiality or availability impact, but the integrity bypass could facilitate downstream attacks such as code signing fraud, malicious software distribution, or impersonation in PKI-dependent workflows (AWS Bulletin, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability was discovered and responsibly disclosed by Joshua Rogers of the AISLE Research Team through coordinated disclosure with AWS (AWS Bulletin, GitHub Advisory).

1. Identify target applications: Locate applications that use AWS-LC versions v1.41.0–v1.68.x or aws-lc-sys v0.24.0–v0.37.x for PKCS7 signature verification, such as custom software, AWS SDK integrations, or IBM API Connect deployments.
2. Craft a malicious PKCS7 object: Construct a PKCS7 signed data object with multiple signers, where one or more intermediate signers use an untrusted, self-signed, or forged certificate chain. Only the final signer needs a valid certificate chain to pass verification.
3. Submit the crafted object: Deliver the malicious PKCS7 object to the target application through any input channel that triggers PKCS7_verify() — such as a file upload, API endpoint, or network message accepting signed data.
4. Bypass certificate validation: The vulnerable PKCS7_verify() function skips certificate chain validation for all signers except the last, causing the application to accept the forged or invalid certificate as trusted.
5. Achieve objective: Depending on the application's use of PKCS7 verification, the attacker may successfully impersonate a trusted signer, deliver maliciously signed content, or undermine PKI-based trust decisions (AWS Bulletin, GitHub Advisory).

AWS has released a patch in AWS-LC v1.69.0 and aws-lc-sys v0.38.0, which fully resolve CVE-2026-3336. There are no known workarounds for this vulnerability — upgrading is the only remediation. Customers of managed AWS services do not need to take action, as AWS has already addressed the issue on their end. Organizations using AWS-LC in their own applications or downstream products (e.g., IBM API Connect) should upgrade immediately and audit any PKCS7 signed content processed by vulnerable versions for potential integrity compromise (AWS Bulletin, GitHub Advisory, AWS-LC v1.69.0 Release).

AWS published a formal security bulletin (2026-005-AWS) on March 2, 2026, covering CVE-2026-3336 alongside two related vulnerabilities, and acknowledged the AISLE Research Team for responsible disclosure (AWS Bulletin). Security news outlets including GBHackers, CyberSecurityNews, SecurityOnline, and eSecurity Planet covered the disclosure, highlighting the certificate bypass risk in Amazon's cryptographic library. The vulnerability was also discussed on the oss-security mailing list and noted in The Hacker News weekly recap. Community reaction was measured, with no significant alarm given the absence of active exploitation and the availability of a patch at the time of disclosure (SecurityOnline).