VYPR
← All advisories
Medium severity5.9NVD Advisory· Published Mar 2, 2026· Updated Jun 17, 2026

CVE-2026-3337

CVE-2026-3337

Description

Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis.

The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm.

Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7
  • Amazon/AWS Lc Fips Sys
    cpe:2.3:a:amazon:aws-lc-fips-sys:*:*:*:*:*:rust:*:*
    Range: >=0.13.0,<0.13.12
  • Amazon/AWS Lc Sys
    cpe:2.3:a:amazon:aws-lc-sys:*:*:*:*:*:rust:*:*
    Range: >=0.14.0,<0.38.0
  • Amazon/AWS Libcrypto2 versions
    cpe:2.3:a:amazon:aws_libcrypto:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:amazon:aws_libcrypto:*:*:*:*:*:*:*:*range: >=1.21.0,<1.69.0
    • cpe:2.3:a:amazon:aws_libcrypto:*:*:*:*:fips:*:*:*range: >=3.0.0,<3.2.0
  • AWS/AWS-LCllm-fuzzy3 versions
    >=1.69.0+ 2 more
    • (no CPE)range: >=1.69.0
    • (no CPE)range: 1.21.0
    • (no CPE)range: 3.0.0

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.