https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T21:28:20.676765+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-274114 EUVD-2026-274114 2026-10-08T21:28:20.746710+00:00 EUVD-2026-274114 https://cve.radiocsirt.org/vuln/fkie_cve-2026-3337 fkie_cve-2026-3337 2026-10-08T21:28:20.746749+00:00

Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis.

The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm.

Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

 https://cve.radiocsirt.org/vuln/rustsec-2026-0043 RUSTSEC-2026-0043 — Timing Side-Channel in AES-CCM Tag Verification in AWS-LC 2026-10-08T21:28:20.746786+00:00

Affected: crates.io: aws-lc-fips-sys

Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis.

The impacted implementations are through the EVP CIPHER API: `EVP_aes_128_ccm`, `EVP_aes_192_ccm`, and `EVP_aes_256_ccm`.

Customers of AWS services do not need to take action. `aws-lc-fips-sys` contains code from AWS-LC. Applications using `aws-lc-fips-sys` should upgrade to the most recent release of `aws-lc-fips-sys`.

## Workarounds

In the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations `EVP_aead_aes_128_ccm_bluetooth`, `EVP_aead_aes_128_ccm_bluetooth_8`, and `EVP_aead_aes_128_ccm_matter` respectively.

Otherwise, there is no workaround and applications using `aws-lc-fips-sys` should upgrade to the most recent release of `aws-lc-fips-sys`.