CVE-2026-4428
Fixed in a distro release EPSS <1%CVSS 7.4
A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should upgrade to AWS-LC 1.71.0 or AWS-LC-FIPS-3.3.0.
Products: AWS-LC, AWS-LC-FIPS
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| crates.io | aws-lc-fips-sys | 0.13.13 |
| crates.io | aws-lc-sys | 0.39.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | amazon-efs-utils | 3.0.0-4.amzn2 |
| Amazon Linux 2023 | amazon-efs-utils | 3.0.0-4.amzn2023 |
| Amazon Linux 2023 | aws-nitro-tpm-tools | 1.1.2-1.amzn2023 |
| Amazon Linux 2023 | mount-s3 | 1.22.3-1.amzn2023 |