aws-lc-fips-sys
aws-lc-rs is a cryptographic library using AWS-LC for its cryptographic operations. The library strives to be API-compatible with the popular Rust library named ring.
View on Github
Activity
- Latest release
- 1w ago
- Total releases
- 55
- Cadence
- ~20 days
- Last 12 months
- 12
Reach
- Downloads
- 25.2M
- Stars
- 642
Details
- License
- ISC AND Apache-2.0 OR ISC AND OpenSSL
- First release
- Nov 10, 2022
| Version | Released | |
|---|---|---|
0.14.2
patch
|
0.14.2
patch
Dependencies (8)
Changelog
Compare changes
|
|
0.13.17
patch
|
0.13.17
patch
Dependencies (8)
Changelog
Compare changes
|
|
0.14.1
patch
|
0.14.1
patch
Dependencies (8)
Changelog
Compare changes
|
|
0.14.0
minor
|
0.14.0
minor
Dependencies (8)
Changelog
Compare changes
|
|
0.13.16
unknown
|
0.13.16
unknown
Dependencies (8)
Changelog
Compare changes
|
|
0.13.15
unknown
|
0.13.15
unknown
Dependencies (8)
Changelog
Compare changes
|
|
0.13.14
unknown
|
0.13.14
unknown
Dependencies (7)
Changelog
Compare changes
|
|
0.13.13
unknown
|
0.13.13
unknown
Dependencies (7)
Changelog
Compare changes
|
|
0.13.12
unknown
1 CVE
CVE-2026-4428
GHSA-9f94-5g5w-gf6r
RUSTSEC-2026-0042
RUSTSEC-2026-0048
Mar 20, 2026
CRL Distribution Point Scope Check Logic Error in AWS-LC
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactA logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v0.39.0 and aws-lc-fips-sys v0.13.13. WorkaroundsApplications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ReferencesIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. Fixed in
0.13.13
References Updated Sep 10, 2026 · Source: OSV.dev |
0.13.12
unknown
Dependencies (7)
Changelog
Compare changes
|
|
0.13.11
unknown
2 CVEs
CVE-2026-4428
GHSA-9f94-5g5w-gf6r
RUSTSEC-2026-0042
RUSTSEC-2026-0048
Mar 20, 2026
CRL Distribution Point Scope Check Logic Error in AWS-LC
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactA logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v0.39.0 and aws-lc-fips-sys v0.13.13. WorkaroundsApplications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ReferencesIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. Fixed in
0.13.13
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-3337
GHSA-65p9-r9h6-22vj
GHSA-frmv-5gcm-jwxh
RUSTSEC-2026-0043
RUSTSEC-2026-0045
Mar 03, 2026
AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
High
Network
High
None
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactObservable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v.0.38.0 and aws-lc-fips-sys v0.13.12. WorkaroundsIn the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations EVP_aead_aes_128_ccm_bluetooth, EVP_aead_aes_128_ccm_bluetooth_8, and, EVP_aead_aes_128_ccm_matter respectively. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ResourcesIf there are any questions or comments about this advisory, contact [AWS/Amazon] Security via thevulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. AcknowledgementAWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process. Fixed in
0.13.12
References
Updated Sep 10, 2026 · Source: OSV.dev |
0.13.11
unknown
Dependencies (7)
Changelog
Compare changes
|
|
0.13.10
unknown
2 CVEs
CVE-2026-4428
GHSA-9f94-5g5w-gf6r
RUSTSEC-2026-0042
RUSTSEC-2026-0048
Mar 20, 2026
CRL Distribution Point Scope Check Logic Error in AWS-LC
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactA logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v0.39.0 and aws-lc-fips-sys v0.13.13. WorkaroundsApplications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ReferencesIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. Fixed in
0.13.13
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-3337
GHSA-65p9-r9h6-22vj
GHSA-frmv-5gcm-jwxh
RUSTSEC-2026-0043
RUSTSEC-2026-0045
Mar 03, 2026
AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
High
Network
High
None
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactObservable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v.0.38.0 and aws-lc-fips-sys v0.13.12. WorkaroundsIn the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations EVP_aead_aes_128_ccm_bluetooth, EVP_aead_aes_128_ccm_bluetooth_8, and, EVP_aead_aes_128_ccm_matter respectively. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ResourcesIf there are any questions or comments about this advisory, contact [AWS/Amazon] Security via thevulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. AcknowledgementAWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process. Fixed in
0.13.12
References
Updated Sep 10, 2026 · Source: OSV.dev |
0.13.10
unknown
Dependencies (7)
Changelog
Compare changes
|
|
0.13.9
unknown
2 CVEs
CVE-2026-4428
GHSA-9f94-5g5w-gf6r
RUSTSEC-2026-0042
RUSTSEC-2026-0048
Mar 20, 2026
CRL Distribution Point Scope Check Logic Error in AWS-LC
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactA logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v0.39.0 and aws-lc-fips-sys v0.13.13. WorkaroundsApplications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ReferencesIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. Fixed in
0.13.13
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-3337
GHSA-65p9-r9h6-22vj
GHSA-frmv-5gcm-jwxh
RUSTSEC-2026-0043
RUSTSEC-2026-0045
Mar 03, 2026
AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
High
Network
High
None
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactObservable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v.0.38.0 and aws-lc-fips-sys v0.13.12. WorkaroundsIn the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations EVP_aead_aes_128_ccm_bluetooth, EVP_aead_aes_128_ccm_bluetooth_8, and, EVP_aead_aes_128_ccm_matter respectively. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ResourcesIf there are any questions or comments about this advisory, contact [AWS/Amazon] Security via thevulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. AcknowledgementAWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process. Fixed in
0.13.12
References
Updated Sep 10, 2026 · Source: OSV.dev |
0.13.9
unknown
Dependencies (7)
Changelog
Compare changes
|
|
0.13.8
unknown
2 CVEs
CVE-2026-4428
GHSA-9f94-5g5w-gf6r
RUSTSEC-2026-0042
RUSTSEC-2026-0048
Mar 20, 2026
CRL Distribution Point Scope Check Logic Error in AWS-LC
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactA logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v0.39.0 and aws-lc-fips-sys v0.13.13. WorkaroundsApplications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ReferencesIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. Fixed in
0.13.13
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-3337
GHSA-65p9-r9h6-22vj
GHSA-frmv-5gcm-jwxh
RUSTSEC-2026-0043
RUSTSEC-2026-0045
Mar 03, 2026
AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
High
Network
High
None
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactObservable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v.0.38.0 and aws-lc-fips-sys v0.13.12. WorkaroundsIn the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations EVP_aead_aes_128_ccm_bluetooth, EVP_aead_aes_128_ccm_bluetooth_8, and, EVP_aead_aes_128_ccm_matter respectively. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ResourcesIf there are any questions or comments about this advisory, contact [AWS/Amazon] Security via thevulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. AcknowledgementAWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process. Fixed in
0.13.12
References
Updated Sep 10, 2026 · Source: OSV.dev |
0.13.8
unknown
Dependencies (8)
Changelog
Compare changes
|
|
0.13.7
unknown
2 CVEs
CVE-2026-4428
GHSA-9f94-5g5w-gf6r
RUSTSEC-2026-0042
RUSTSEC-2026-0048
Mar 20, 2026
CRL Distribution Point Scope Check Logic Error in AWS-LC
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactA logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v0.39.0 and aws-lc-fips-sys v0.13.13. WorkaroundsApplications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ReferencesIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. Fixed in
0.13.13
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-3337
GHSA-65p9-r9h6-22vj
GHSA-frmv-5gcm-jwxh
RUSTSEC-2026-0043
RUSTSEC-2026-0045
Mar 03, 2026
AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
High
Network
High
None
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactObservable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v.0.38.0 and aws-lc-fips-sys v0.13.12. WorkaroundsIn the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations EVP_aead_aes_128_ccm_bluetooth, EVP_aead_aes_128_ccm_bluetooth_8, and, EVP_aead_aes_128_ccm_matter respectively. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ResourcesIf there are any questions or comments about this advisory, contact [AWS/Amazon] Security via thevulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. AcknowledgementAWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process. Fixed in
0.13.12
References
Updated Sep 10, 2026 · Source: OSV.dev |
0.13.7
unknown
Dependencies (7)
Changelog
Compare changes
|
|
0.13.6
unknown
2 CVEs
CVE-2026-4428
GHSA-9f94-5g5w-gf6r
RUSTSEC-2026-0042
RUSTSEC-2026-0048
Mar 20, 2026
CRL Distribution Point Scope Check Logic Error in AWS-LC
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactA logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v0.39.0 and aws-lc-fips-sys v0.13.13. WorkaroundsApplications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ReferencesIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. Fixed in
0.13.13
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-3337
GHSA-65p9-r9h6-22vj
GHSA-frmv-5gcm-jwxh
RUSTSEC-2026-0043
RUSTSEC-2026-0045
Mar 03, 2026
AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
High
Network
High
None
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactObservable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v.0.38.0 and aws-lc-fips-sys v0.13.12. WorkaroundsIn the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations EVP_aead_aes_128_ccm_bluetooth, EVP_aead_aes_128_ccm_bluetooth_8, and, EVP_aead_aes_128_ccm_matter respectively. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ResourcesIf there are any questions or comments about this advisory, contact [AWS/Amazon] Security via thevulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. AcknowledgementAWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process. Fixed in
0.13.12
References
Updated Sep 10, 2026 · Source: OSV.dev |
0.13.6
unknown
Dependencies (7)
Changelog
Compare changes
|
|
0.13.5
unknown
2 CVEs
CVE-2026-4428
GHSA-9f94-5g5w-gf6r
RUSTSEC-2026-0042
RUSTSEC-2026-0048
Mar 20, 2026
CRL Distribution Point Scope Check Logic Error in AWS-LC
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactA logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v0.39.0 and aws-lc-fips-sys v0.13.13. WorkaroundsApplications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ReferencesIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. Fixed in
0.13.13
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-3337
GHSA-65p9-r9h6-22vj
GHSA-frmv-5gcm-jwxh
RUSTSEC-2026-0043
RUSTSEC-2026-0045
Mar 03, 2026
AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
High
Network
High
None
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactObservable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v.0.38.0 and aws-lc-fips-sys v0.13.12. WorkaroundsIn the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations EVP_aead_aes_128_ccm_bluetooth, EVP_aead_aes_128_ccm_bluetooth_8, and, EVP_aead_aes_128_ccm_matter respectively. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ResourcesIf there are any questions or comments about this advisory, contact [AWS/Amazon] Security via thevulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. AcknowledgementAWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process. Fixed in
0.13.12
References
Updated Sep 10, 2026 · Source: OSV.dev |
0.13.5
unknown
Dependencies (7)
Changelog
Compare changes
|
|
0.13.4
unknown
2 CVEs
CVE-2026-4428
GHSA-9f94-5g5w-gf6r
RUSTSEC-2026-0042
RUSTSEC-2026-0048
Mar 20, 2026
CRL Distribution Point Scope Check Logic Error in AWS-LC
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactA logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v0.39.0 and aws-lc-fips-sys v0.13.13. WorkaroundsApplications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ReferencesIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. Fixed in
0.13.13
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-3337
GHSA-65p9-r9h6-22vj
GHSA-frmv-5gcm-jwxh
RUSTSEC-2026-0043
RUSTSEC-2026-0045
Mar 03, 2026
AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
High
Network
High
None
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactObservable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v.0.38.0 and aws-lc-fips-sys v0.13.12. WorkaroundsIn the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations EVP_aead_aes_128_ccm_bluetooth, EVP_aead_aes_128_ccm_bluetooth_8, and, EVP_aead_aes_128_ccm_matter respectively. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ResourcesIf there are any questions or comments about this advisory, contact [AWS/Amazon] Security via thevulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. AcknowledgementAWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process. Fixed in
0.13.12
References
Updated Sep 10, 2026 · Source: OSV.dev |
0.13.4
unknown
Dependencies (7)
Changelog
Compare changes
|
|
0.13.3
unknown
2 CVEs
CVE-2026-4428
GHSA-9f94-5g5w-gf6r
RUSTSEC-2026-0042
RUSTSEC-2026-0048
Mar 20, 2026
CRL Distribution Point Scope Check Logic Error in AWS-LC
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactA logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v0.39.0 and aws-lc-fips-sys v0.13.13. WorkaroundsApplications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ReferencesIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. Fixed in
0.13.13
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-3337
GHSA-65p9-r9h6-22vj
GHSA-frmv-5gcm-jwxh
RUSTSEC-2026-0043
RUSTSEC-2026-0045
Mar 03, 2026
AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
High
Network
High
None
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactObservable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v.0.38.0 and aws-lc-fips-sys v0.13.12. WorkaroundsIn the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations EVP_aead_aes_128_ccm_bluetooth, EVP_aead_aes_128_ccm_bluetooth_8, and, EVP_aead_aes_128_ccm_matter respectively. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ResourcesIf there are any questions or comments about this advisory, contact [AWS/Amazon] Security via thevulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. AcknowledgementAWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process. Fixed in
0.13.12
References
Updated Sep 10, 2026 · Source: OSV.dev |
0.13.3
unknown
Dependencies (8)
Changelog
Compare changes
|
|
0.13.2
unknown
2 CVEs
CVE-2026-4428
GHSA-9f94-5g5w-gf6r
RUSTSEC-2026-0042
RUSTSEC-2026-0048
Mar 20, 2026
CRL Distribution Point Scope Check Logic Error in AWS-LC
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactA logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v0.39.0 and aws-lc-fips-sys v0.13.13. WorkaroundsApplications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ReferencesIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. Fixed in
0.13.13
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-3337
GHSA-65p9-r9h6-22vj
GHSA-frmv-5gcm-jwxh
RUSTSEC-2026-0043
RUSTSEC-2026-0045
Mar 03, 2026
AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
High
Network
High
None
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactObservable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v.0.38.0 and aws-lc-fips-sys v0.13.12. WorkaroundsIn the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations EVP_aead_aes_128_ccm_bluetooth, EVP_aead_aes_128_ccm_bluetooth_8, and, EVP_aead_aes_128_ccm_matter respectively. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ResourcesIf there are any questions or comments about this advisory, contact [AWS/Amazon] Security via thevulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. AcknowledgementAWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process. Fixed in
0.13.12
References
Updated Sep 10, 2026 · Source: OSV.dev |
0.13.2
unknown
Dependencies (8)
Changelog
Compare changes
|
|
0.13.1
unknown
2 CVEs
CVE-2026-4428
GHSA-9f94-5g5w-gf6r
RUSTSEC-2026-0042
RUSTSEC-2026-0048
Mar 20, 2026
CRL Distribution Point Scope Check Logic Error in AWS-LC
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactA logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v0.39.0 and aws-lc-fips-sys v0.13.13. WorkaroundsApplications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ReferencesIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. Fixed in
0.13.13
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-3337
GHSA-65p9-r9h6-22vj
GHSA-frmv-5gcm-jwxh
RUSTSEC-2026-0043
RUSTSEC-2026-0045
Mar 03, 2026
AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
High
Network
High
None
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactObservable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v.0.38.0 and aws-lc-fips-sys v0.13.12. WorkaroundsIn the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations EVP_aead_aes_128_ccm_bluetooth, EVP_aead_aes_128_ccm_bluetooth_8, and, EVP_aead_aes_128_ccm_matter respectively. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ResourcesIf there are any questions or comments about this advisory, contact [AWS/Amazon] Security via thevulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. AcknowledgementAWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process. Fixed in
0.13.12
References
Updated Sep 10, 2026 · Source: OSV.dev |
0.13.1
unknown
Dependencies (8)
Changelog
Compare changes
|
|
0.13.0
unknown
2 CVEs
CVE-2026-4428
GHSA-9f94-5g5w-gf6r
RUSTSEC-2026-0042
RUSTSEC-2026-0048
Mar 20, 2026
CRL Distribution Point Scope Check Logic Error in AWS-LC
7.4
/ 10
High
Network
High
None
None
Unchanged
High
High
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactA logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point (IDP) extensions. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v0.39.0 and aws-lc-fips-sys v0.13.13. WorkaroundsApplications can workaround this issue if they do not enable CRL checking (X509_V_FLAG_CRL_CHECK). Applications using complete (non-partitioned) CRLs without IDP extensions are also not affected. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ReferencesIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. Fixed in
0.13.13
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-3337
GHSA-65p9-r9h6-22vj
GHSA-frmv-5gcm-jwxh
RUSTSEC-2026-0043
RUSTSEC-2026-0045
Mar 03, 2026
AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
High
Network
High
None
None
SummaryAWS-LC is an open-source, general-purpose cryptographic library. ImpactObservable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. aws-lc-sys and aws-lc-fips-sys contain code from AWS-LC. Applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. Impacted versions:
PatchesThe patch is included in aws-lc-sys v.0.38.0 and aws-lc-fips-sys v0.13.12. WorkaroundsIn the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations EVP_aead_aes_128_ccm_bluetooth, EVP_aead_aes_128_ccm_bluetooth_8, and, EVP_aead_aes_128_ccm_matter respectively. Otherwise, there is no workaround and applications using aws-lc-sys or aws-lc-fips-sys should upgrade to the most recent releases of aws-lc-sys or aws-lc-fips-sys. ResourcesIf there are any questions or comments about this advisory, contact [AWS/Amazon] Security via thevulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. AcknowledgementAWS-LC would like to thank Joshua Rogers (https://joshua.hu/) for collaborating on this issue through the coordinated vulnerability disclosure process. Fixed in
0.13.12
References
Updated Sep 10, 2026 · Source: OSV.dev |
0.13.0
unknown
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.12.15
unknown
|
0.12.15
unknown
Dependencies (7)
Changelog
Compare changes
|
|
0.12.14
unknown
|
0.12.14
unknown
Dependencies (7)
Changelog
Compare changes
|
|
0.12.13
unknown
|
0.12.13
unknown
Dependencies (7)
Changelog
Compare changes
|
|
0.12.12
unknown
| ||
0.12.11
unknown
| ||
0.12.10
unknown
| ||
0.12.9
unknown
| ||
0.12.8
unknown
| ||
0.12.7
unknown
| ||
0.12.6
unknown
yanked
|
0.12.6
unknown
yanked
Dependencies (6)
Changelog
Compare changes
|
|
0.12.5
unknown
| ||
0.12.4
unknown
| ||
0.12.3
unknown
| ||
0.12.2
unknown
yanked
| ||
0.12.1
unknown
| ||
0.12.0
unknown
| ||
0.11.2
unknown
| ||
0.11.1
unknown
| ||
0.11.0
unknown
| ||
0.10.1
unknown
| ||
0.10.0
unknown
| ||
0.9.1
unknown
| ||
0.9.0
unknown
| ||
0.8.0
unknown
| ||
0.7.1
unknown
| ||
0.7.0
unknown
| ||
0.6.0
unknown
| ||
0.5.0
unknown
| ||
0.4.0
unknown
|