Most recent entries from all

EUVD-2026-357262

2026-10-03T01:40:11.026110+00:00

EUVD-2026-357262

fkie_cve-2026-3336

2026-10-03T01:40:11.026150+00:00

Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.

Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

msrc_CVE-2026-3336 — PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

2026-10-03T01:40:11.026195+00:00

msrc_CVE-2026-3336

RHSA-2026:5459 — Red Hat Security Advisory: RHTAS 1.3.3 - Red Hat Trusted Artifact Signer Release

2026-10-03T01:40:11.026223+00:00

urllib3: urllib3 Streaming API improperly handles highly compressed data aws-lc: aws-lc: Certificate validation bypass via improper handling of PKCS7 objects aws-lc: AWS-LC: Signature bypass due to improper validation in PKCS7_verify() urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) quinn-proto: quinn-proto: Denial of Service via crafted QUIC Initial packet

RUSTSEC-2026-0046 — PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

2026-10-03T01:40:11.026259+00:00

Affected: crates.io: aws-lc-sys

Improper certificate validation in `PKCS7_verify()` in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.

Customers of AWS services do not need to take action. `aws-lc-sys` contains code from AWS-LC. Applications using `aws-lc-sys` should upgrade to the most recent release of `aws-lc-sys`.

There is no workaround; applications using `aws-lc-sys` should upgrade to the most recent release of aws-lc-sys.