AWS credits AISLE on two AWS-LC cryptography CVEs

AWS thanks AISLE for a PKCS7 certificate-chain verification bypass and an AES-CCM timing issue fixed in AWS-LC 1.69.0.

Bug class: Certificate-chain verification bypass and cryptographic timing side channel
Affected codebase: AWS-LC, fixed in 1.69.0
Credited system: AISLE
Disclosed: March 2, 2026
Attribution: Self-reported attribution
AI role: Discovery
Severity: high

Source status: AWS Security Bulletin 2026-005 thanks AISLE for CVE-2026-3336 and CVE-2026-3337 and identifies AWS-LC 1.69.0 as fixed. AISLE supplies the AI-system attribution.

Summary

CVE-2026-3336 affects certificate-chain verification in PKCS7_verify() with multiple signers. CVE-2026-3337 is a timing side channel in AES-CCM tag verification. AWS-LC 1.69.0 fixes both.

The group uses high because CVE-2026-3336 is CVSS v3.1 7.5; CVE-2026-3337 is medium at 5.9. Their CVSS v4.0 values are 8.7 and 8.2 respectively. This page credits only those two AISLE findings from the three-CVE AWS bulletin.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.