Skip to main content

CVE-2026-4428: Issues with AWS-LC - CRL Distribution Point Scope Check Logic Error

Bulletin ID: 2026-010-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 03/19/2026 13:30 PM PDT
 

Description:

AWS-LC is a general-purpose cryptographic library maintained by AWS. We identified CVE-2026-4428 affecting X.509 certificate verification.

A logic error in the CRL (Certificate Revocation List) distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions.

Applications that do not enable CRL checking (X509_V_FLAG_CRL_CHECK) are not affected. Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected.

Impacted versions:

  • CRL Distribution Point Scope Check Logic Error in AWS-LC >= v1.24.0, < v1.71.0
  • CRL Distribution Point Scope Check Logic Error in AWS-LC-FIPS >= AWS-LC-FIPS-3.0.0, < AWS-LC-FIPS-3.3.0
  • CRL Distribution Point Scope Check Logic Error in aws-lc-sys >= v0.15.0, < v0.39.0
  • CRL Distribution Point Scope Check Logic Error in aws-lc-fips-sys >= v0.13.0, < v0.13.13

Resolution:

These issues have been addressed in AWS-LC version v1.71.0, AWS-LC-FIPS version AWS-LC-FIPS-3.3.0, aws-lc-sys version v0.39.0, and aws-lc-fips-sys version v0.13.13. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

Applications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected.

References:


Please email aws-security@amazon.com with any security questions or concerns.