5.9
Medium
CVE-2026-3337 Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine…
Description
Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| AWS-LC 1.21 | 1.21.0 → < 1.69.0 | 1.69.0 |
| AWS-LC-FIPS 3.0 | 3.0.0 → < 3.2.0 | 3.2.0 |
References
- aws.amazon.com aws.amazon.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of AWS-LC
The 4 CVEs of AWS-LC →
CVE-2026-4428
A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly…
7.4
High
CVE-2026-3338
Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature…
7.5
High
CVE-2026-3336
Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain…
7.5
High