{"id":"CVE-2026-3337","details":"Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis.\n\n\n\n\nThe impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm.\n\n\n\n\nCustomers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.","aliases":["GHSA-65p9-r9h6-22vj","GHSA-frmv-5gcm-jwxh","RUSTSEC-2026-0043","RUSTSEC-2026-0045"],"modified":"2026-04-02T13:34:30.812442Z","published":"2026-03-02T22:16:32.093Z","references":[{"type":"ADVISORY","url":"https://aws.amazon.com/security/security-bulletins/2026-005-AWS/"},{"type":"ADVISORY","url":"https://github.com/aws/aws-lc/releases/tag/v1.69.0"},{"type":"ADVISORY","url":"https://github.com/aws/aws-lc/security/advisories/GHSA-frmv-5gcm-jwxh"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/aws/aws-lc","events":[{"introduced":"19d9ace40f6770e062b1e9ec1d46935b300b948e"},{"fixed":"37d86461a95782fd5d8b77873f9e1cb134ea2f95"},{"introduced":"190be0667cf1f7b39bed2c96760f08a6295b652b"},{"fixed":"e50a5f29ee416a7c99be4e72957e8f96aa51dbb9"}],"database_specific":{"versions":[{"introduced":"1.21.0"},{"fixed":"1.69.0"},{"introduced":"3.0.0"},{"fixed":"3.2.0"}]}}],"versions":["AWS-LC-FIPS-3.0.0","AWS-LC-FIPS-3.1.0","AWS-LC-FIPS-NETOS-v1.29.1","v1.21.0","v1.22.0","v1.23.0","v1.24.0","v1.24.1","v1.25.0","v1.26.0","v1.27.0","v1.28.0","v1.29.0","v1.30.0","v1.30.1","v1.31.0","v1.32.0","v1.33.0","v1.34.0","v1.34.1","v1.34.2","v1.35.0","v1.35.1","v1.36.0","v1.36.1","v1.37.0","v1.38.0","v1.39.0","v1.40.0","v1.41.0","v1.41.1","v1.42.0","v1.43.0","v1.44.0","v1.45.0","v1.46.0","v1.46.1","v1.47.0","v1.48.0","v1.48.1","v1.48.2","v1.48.3","v1.48.4","v1.48.5","v1.49.0","v1.49.1","v1.50.0","v1.50.1","v1.51.0","v1.51.1","v1.51.2","v1.52.0","v1.52.1","v1.53.0","v1.53.1","v1.54.0","v1.55.0","v1.56.0","v1.57.0","v1.57.1","v1.58.0","v1.58.1","v1.59.0","v1.60.0","v1.61.0","v1.61.1","v1.61.2","v1.61.3","v1.61.4","v1.62.0","v1.62.1","v1.63.0","v1.64.0","v1.65.0","v1.65.1","v1.66.0","v1.66.1","v1.66.2","v1.67.0","v1.68.0"],"database_specific":{"vanir_signatures":[{"target":{"file":"crypto/pkcs7/pkcs7.c"},"source":"https://github.com/aws/aws-lc/commit/37d86461a95782fd5d8b77873f9e1cb134ea2f95","signature_type":"Line","id":"CVE-2026-3337-855e3c0b","deprecated":false,"digest":{"threshold":0.9,"line_hashes":["280062061547051961335040704369984099310","59664889025735122861240116516903930146","186491128754061308478941699848016839286","44181818329089001225657707026569626534","282671460555005303787248492658194669900","44166289732973386761265031133498341556","69817426707179551398336772625900832321","239604874112229803444893855053965253409"]},"signature_version":"v1"},{"target":{"file":"crypto/pkcs7/pkcs7.c","function":"pkcs7_signature_verify"},"source":"https://github.com/aws/aws-lc/commit/37d86461a95782fd5d8b77873f9e1cb134ea2f95","signature_type":"Function","id":"CVE-2026-3337-dc456f72","deprecated":false,"digest":{"function_hash":"158135805622728784577576606639969624490","length":2013},"signature_version":"v1"},{"target":{"file":"crypto/fipsmodule/cipher/e_aesccm.c"},"source":"https://github.com/aws/aws-lc/commit/e50a5f29ee416a7c99be4e72957e8f96aa51dbb9","signature_type":"Line","id":"CVE-2026-3337-ef5cea45","deprecated":false,"digest":{"threshold":0.9,"line_hashes":["273085439071910207277154200794602786021","245468422534222847041479036646193063170","54101678788672349656736281287579255679","151537791126997683886016466598243283979"]},"signature_version":"v1"}],"unresolved_ranges":[{"events":[{"introduced":"0.13.0"},{"fixed":"0.13.12"}]},{"events":[{"introduced":"0.14.0"},{"fixed":"0.38.0"}]}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3337.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]}