CVE-2026-4428 — Improper Check for Certificate Revocation in Aws-lc-fips

CWE-299 — Improper Check for Certificate RevocationCWE-295 — Improper Certificate Validation6 documents4 sources
Severity
9.1CRITICALNVD
EPSS
0.0%
top 93.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
AWS Aws-lcAWS Aws-lc-fipsAmazon Aws-lc-sys
Timeline
PublishedMar 19
Latest updateMar 20

Description

A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should upgrade to AWS-LC 1.71.0 or AWS-LC-FIPS-3.3.0.

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Packages3 packages

▶CVEListV5aws/aws-lc-fips3.0.0 — 3.3.0
▶CVEListV5aws/aws-lc1.24.0 — 1.71.0
▶crates.ioamazon/aws-lc-sys0.15.0 — 0.39.0

🔴Vulnerability Details

3
OSV
CRL Distribution Point Scope Check Logic Error in AWS-LC↗2026-03-20
▶
OSV
CRL Distribution Point Scope Check Logic Error in AWS-LC↗2026-03-19
▶
OSV
CRL Distribution Point Scope Check Logic Error in AWS-LC↗2026-03-19
▶

📋Vendor Advisories

1
Red Hat
AWS-LC: AWS-LC: Security bypass allows revoked certificates to be accepted due to CRL validation error↗2026-03-19
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-4428 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶