AWS-LC Flaw Exposes Amazon Users to Attacks by Bypassing Certificate Chain Validation

Amazon published security bulletin 2026-005-AWS describing three high-severity vulnerabilities in the AWS-LC cryptographic library—two PKCS7-related certificate/signature validation bypasses and an AES-CCM timing side-channel (CVE-2026-3336, CVE-2026-3337, CVE-2026-3338). The flaws affect a broad range of AWS-LC and aws-lc-sys versions (including some FIPS builds); Amazon released patches in v1.69.0 and related package updates and recommends immediate patching, noting no workaround for the PKCS7 bypasses and a limited temporary mitigation for the timing issue via specific EVP AEAD configurations.