{"id":"CVE-2026-3337","summary":"Timing Side-Channel in AES-CCM Tag Verification in AWS-LC","details":"Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis.\n\n\n\n\nThe impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm.\n\n\n\n\nCustomers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.","aliases":["GHSA-65p9-r9h6-22vj","GHSA-frmv-5gcm-jwxh","RUSTSEC-2026-0043","RUSTSEC-2026-0045"],"modified":"2026-08-12T15:33:21.663374Z","published":"2026-03-02T21:20:08.532Z","database_specific":{"cwe_ids":["CWE-208"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3337.json","cna_assigner":"AMZN"},"references":[{"type":"ADVISORY","url":"https://aws.amazon.com/security/security-bulletins/2026-005-AWS/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3337.json"},{"type":"ADVISORY","url":"https://github.com/aws/aws-lc/security/advisories/GHSA-frmv-5gcm-jwxh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3337"},{"type":"FIX","url":"https://github.com/aws/aws-lc/releases/tag/v1.69.0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/aws/aws-lc","events":[{"introduced":"19d9ace40f6770e062b1e9ec1d46935b300b948e"},{"fixed":"37d86461a95782fd5d8b77873f9e1cb134ea2f95"},{"introduced":"190be0667cf1f7b39bed2c96760f08a6295b652b"},{"fixed":"e50a5f29ee416a7c99be4e72957e8f96aa51dbb9"}],"database_specific":{"cpe":["cpe:2.3:a:amazon:aws_libcrypto:*:*:*:*:*:*:*:*","cpe:2.3:a:amazon:aws_libcrypto:*:*:*:*:fips:*:*:*"],"extracted_events":[{"introduced":"1.21.0"},{"fixed":"1.69.0"},{"introduced":"3.0.0"},{"fixed":"3.2.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v1.68.0","AWS-LC-FIPS-3.1.0","v1.67.0","v1.66.2","v1.66.1","v1.66.0","AWS-LC-FIPS-NETOS-v1.29.1","v1.65.1","v1.65.0","v1.64.0","v1.63.0","v1.62.1","v1.62.0","v1.61.4","v1.61.3","v1.61.2","v1.61.1","v1.61.0","v1.60.0","v1.59.0","v1.58.1","v1.58.0","v1.57.1","v1.57.0","v1.56.0","v1.55.0","v1.54.0","v1.53.1","v1.53.0","v1.52.1","v1.52.0","v1.51.2","v1.51.1","v1.51.0","v1.50.1","v1.50.0","v1.49.1","v1.49.0","v1.48.5","v1.48.4","v1.48.3","v1.48.2","v1.48.1","v1.48.0","v1.47.0","AWS-LC-FIPS-3.0.0","v1.46.1","v1.46.0","v1.45.0","v1.44.0","v1.43.0","v1.42.0","v1.41.1","v1.41.0","v1.40.0","v1.39.0","v1.38.0","v1.37.0","v1.36.1","v1.36.0","v1.35.1","v1.35.0","v1.34.2","v1.34.1","v1.34.0","v1.33.0","v1.29.0","v1.32.0","v1.31.0","v1.30.1","v1.30.0","v1.28.0","v1.27.0","v1.26.0","v1.25.0","v1.24.1","v1.24.0","v1.23.0","v1.22.0","v1.21.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3337.json","vanir_signatures_modified":"2026-08-12T15:33:21Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/aws/aws-lc/commit/37d86461a95782fd5d8b77873f9e1cb134ea2f95","target":{"file":"crypto/pkcs7/pkcs7.c"},"deprecated":false,"digest":{"line_hashes":["280062061547051961335040704369984099310","59664889025735122861240116516903930146","186491128754061308478941699848016839286","44181818329089001225657707026569626534","282671460555005303787248492658194669900","44166289732973386761265031133498341556","69817426707179551398336772625900832321","239604874112229803444893855053965253409"],"threshold":0.9},"id":"CVE-2026-3337-855e3c0b","signature_type":"Line"},{"digest":{"function_hash":"158135805622728784577576606639969624490","length":2013},"id":"CVE-2026-3337-dc456f72","signature_type":"Function","signature_version":"v1","source":"https://github.com/aws/aws-lc/commit/37d86461a95782fd5d8b77873f9e1cb134ea2f95","target":{"file":"crypto/pkcs7/pkcs7.c","function":"pkcs7_signature_verify"},"deprecated":false},{"target":{"file":"crypto/fipsmodule/cipher/e_aesccm.c"},"deprecated":false,"digest":{"line_hashes":["273085439071910207277154200794602786021","245468422534222847041479036646193063170","54101678788672349656736281287579255679","151537791126997683886016466598243283979"],"threshold":0.9},"id":"CVE-2026-3337-ef5cea45","signature_type":"Line","signature_version":"v1","source":"https://github.com/aws/aws-lc/commit/e50a5f29ee416a7c99be4e72957e8f96aa51dbb9"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}