by Kastro
Paper/Archive/CVE-2026-4428

CVE-2026-4428

AWS AWS-LC — CRL Distribution Point Scope Check Logic Error in AWS-LC

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
31
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 17.4.174 × 203.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should upgrade to AWS-LC 1.71.0 or AWS-LC-FIPS-3.3.0.

Affected

ProductAffectedFixed inSource
AWS-LC1.24.0 – < 1.71.01.71.0CNA
AWS-LC-FIPS3.0.0 – < 3.3.03.3.0CNA

Scores by source

AMZN (CNA)9.1CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
AMZN (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryaws.amazon.com/security/security-bulletins/2026-010-AWSpatchgithub.com/aws/aws-lc/releases/tag/v1.71.0