CVE-2026-4428: 
Rust vulnerability analysis and mitigation

CVE-2026-4428 is a CRL distribution point scope check logic error in AWS-LC (Amazon's general-purpose cryptographic library) that allows revoked certificates to bypass certificate revocation checks. The flaw affects AWS-LC versions >= v1.24.0 and < v1.71.0, AWS-LC-FIPS versions >= 3.0.0 and < 3.3.0, aws-lc-sys >= v0.15.0 and < v0.39.0, and aws-lc-fips-sys >= v0.13.0 and < v0.13.13. It was published on March 19, 2026, with patches released the same day. The vulnerability carries a CVSS v3.1 base score of 7.4 (High) and a CVSS v4.0 base score of 9.1 (Critical) (AWS Security Bulletin, Red Hat CVE).

The root cause is a logic error (CWE-299: Improper Check for Certificate Revocation; CWE-295: Improper Certificate Validation) in the crl_crldp_check function within AWS-LC's X.509 certificate verification code. When an application enables CRL checking (X509_V_FLAG_CRL_CHECK) and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions, the library incorrectly rejects the CRL as out of scope for the certificate being validated, causing revocation checks to silently pass for revoked certificates. Applications that do not enable CRL checking, or that use complete (non-partitioned) CRLs without IDP extensions, are not affected. The fix was implemented in commit #3105 (Fix CRL distribution point scope check logic in crl_crldp_check) included in the v1.71.0 release (AWS Security Bulletin, GitHub Release).

Successful exploitation allows an attacker holding a revoked certificate to have it accepted as valid by applications using AWS-LC for TLS or other certificate-based authentication. This enables impersonation of legitimate services or entities, creating conditions for man-in-the-middle (MitM) attacks, unauthorized access, and interception or modification of sensitive communications. The vulnerability has high confidentiality and integrity impacts with no availability impact, as compromised certificates could be used to decrypt or forge encrypted traffic (AWS Security Bulletin, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.017% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to possess a certificate that has been revoked and to be in a position to present it to a target application that uses AWS-LC with CRL checking enabled and partitioned CRLs — conditions that raise the attack complexity (AWS Security Bulletin, Red Hat CVE).

1. Obtain a revoked certificate: The attacker must acquire a certificate (e.g., a previously valid TLS client or server certificate) that has been revoked by its issuing CA and listed in a partitioned CRL with an Issuing Distribution Point (IDP) extension.
2. Identify a vulnerable target: Locate an application or service that uses AWS-LC versions >= v1.24.0 and < v1.71.0 (or equivalent FIPS/Rust crate versions) with CRL checking explicitly enabled (X509_V_FLAG_CRL_CHECK) and configured to use partitioned CRLs.
3. Present the revoked certificate: Initiate a TLS handshake or other certificate-based authentication flow with the target, presenting the revoked certificate.
4. Trigger the logic error: AWS-LC's crl_crldp_check function incorrectly rejects the partitioned CRL as out of scope for the certificate, causing the revocation check to pass without flagging the certificate as revoked.
5. Achieve impersonation or MitM: With the revoked certificate accepted as valid, the attacker can impersonate a legitimate entity, intercept encrypted communications, or gain unauthorized access to protected resources (AWS Security Bulletin).

Users should upgrade to the following patched versions: AWS-LC v1.71.0, AWS-LC-FIPS-3.3.0, aws-lc-sys v0.39.0, or aws-lc-fips-sys v0.13.13. As a temporary workaround, applications can disable CRL checking by not setting the X509_V_FLAG_CRL_CHECK flag, or by switching to complete (non-partitioned) CRLs without IDP extensions — either approach prevents the vulnerable code path from being triggered. Organizations should audit all systems using AWS-LC or its Rust crate wrappers to identify vulnerable versions and prioritize upgrades given the critical CVSS v4.0 score (AWS Security Bulletin, GitHub Release).

AWS published a formal security bulletin (2026-010-AWS) on March 19, 2026, classifying the issue as "Important" and providing detailed remediation guidance. Red Hat tracked the issue via Bugzilla (Bug 2449205) with medium severity, and IBM issued an advisory noting impact on IBM API Connect. The Rust security advisory database published RUSTSEC-2026-0042 covering the affected Rust crates. Community discussion was observed on Infosec.exchange and Bluesky, and the vulnerability was covered by security aggregators including Tenable (Nessus plugins 303221, 315654, 306191, 306268) and VulDB (AWS Security Bulletin, Red Hat Bugzilla).