Vulnerability RUSTSEC-2026-0046
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
8 months ago
March 02, 2026 at 12:00 PM UTC
PKCS7_verify Certificate Chain Validation Bypass in AWS-LC
>=0.24.0 <0.38.0
>=0.24.0 <0.38.0
Summary
PKCS7_verify Certificate Chain Validation Bypass in AWS-LC
Details
Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.
Customers of AWS services do not need to take action. aws-lc-sys contains code from AWS-LC. Applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys.
There is no workaround; applications using aws-lc-sys should upgrade to the most recent release of aws-lc-sys.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
7 months ago
CRL Distribution Point Scope Check Logic Error in AWS-LC
>=0.15.0 <0.39.0 GHSA-9f94-5g5w-gf6r
>=0.15.0 <0.39.0 GHSA-9f94-5g5w-gf6r
High Risk
7 months ago
AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN
>=0.32.0 <0.39.0 GHSA-394x-vwmw-crm3
>=0.32.0 <0.39.0 GHSA-394x-vwmw-crm3
Unknown
7 months ago
AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN
>=0.32.0 <0.39.0 RUSTSEC-2026-0044
>=0.32.0 <0.39.0 RUSTSEC-2026-0044
High Risk
7 months ago
CRL Distribution Point Scope Check Logic Error in AWS-LC
>=0.15.0 <0.39.0 RUSTSEC-2026-0048
>=0.15.0 <0.39.0 RUSTSEC-2026-0048
High Risk
8 months ago
AWS-LC has PKCS7_verify Signature Validation Bypass
>=0.24.0 <0.38.0 GHSA-hfpc-8r3f-gw53
>=0.24.0 <0.38.0 GHSA-hfpc-8r3f-gw53
Impacted packages
Timeline
Published
8 months ago
March 02, 2026 at 12:00 PM UTC
Fixed (0.38.0)
8 months ago
March 02, 2026 at 10:05 PM UTC
Last Modified
13 hours ago
November 09, 2026 at 11:00 AM UTC