CVE-2026-3337: AWS-LC Timing Discrepancy Vulnerability

CVE-2026-3337 Overview

CVE-2026-3337 is a timing attack vulnerability in the AES-CCM decryption implementation within AWS-LC (AWS Libcrypto). This cryptographic side-channel vulnerability allows an unauthenticated attacker to potentially determine authentication tag validity through careful timing analysis of the decryption process. The vulnerability represents a significant cryptographic weakness that could undermine the integrity guarantees provided by authenticated encryption.

The impacted implementations are accessible through the EVP CIPHER API, specifically affecting EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm functions. Applications utilizing these cipher implementations may be susceptible to attackers who can measure response times to infer information about cryptographic operations.

Critical Impact

Attackers can exploit observable timing discrepancies during AES-CCM decryption to determine whether authentication tags are valid, potentially enabling forgery attacks or bypassing cryptographic integrity protections in affected applications.

Affected Products

• AWS-LC versions prior to 1.69.0
• Applications using EVP_aes_128_ccm cipher implementation
• Applications using EVP_aes_192_ccm cipher implementation
• Applications using EVP_aes_256_ccm cipher implementation

Discovery Timeline

• 2026-03-02 - CVE-2026-3337 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2026-3337

Vulnerability Analysis

This vulnerability falls under CWE-208 (Observable Timing Discrepancy), a well-known class of side-channel attacks affecting cryptographic implementations. The core issue lies in the AES-CCM decryption routine's non-constant-time behavior when validating authentication tags.

In properly implemented authenticated encryption, the time taken to process valid versus invalid authentication tags should be indistinguishable to an external observer. However, the affected AWS-LC implementations exhibit measurable timing differences during tag validation, creating an observable side channel. An attacker positioned to measure these timing discrepancies—either through network latency measurements or local timing—can systematically probe the decryption process to distinguish between valid and invalid authentication tags.

The network-accessible nature of this vulnerability is particularly concerning, as it enables remote exploitation without authentication. While the attack requires high complexity and precise timing measurements, sophisticated adversaries with the ability to perform repeated queries could exploit this weakness to forge encrypted messages or bypass integrity checks.

Root Cause

The root cause is non-constant-time comparison logic in the AES-CCM authentication tag validation code path within AWS-LC. When comparing the computed authentication tag against the provided tag, the implementation introduces timing variations that correlate with the correctness of the tag bytes. This violates the fundamental principle of constant-time cryptographic operations, which requires that execution time remain independent of secret data or comparison results.

Attack Vector

The attack exploits network-accessible timing discrepancies in the AES-CCM decryption process. An attacker conducts the attack by:

1. Sending multiple decryption requests with crafted ciphertexts and authentication tags
2. Measuring the precise response times for each request
3. Performing statistical analysis to identify timing variations correlated with tag validity
4. Using the leaked timing information to progressively determine valid authentication tag values

This timing oracle attack can be conducted remotely over a network, though it requires high attack complexity due to the need for precise timing measurements and statistical analysis across many samples. The vulnerability does not require any user interaction or privileges to exploit.

Detection Methods for CVE-2026-3337

Indicators of Compromise

• Unusual patterns of decryption requests with varying authentication tags from a single source
• High-frequency requests to endpoints performing AES-CCM decryption operations
• Statistical anomalies in request patterns suggesting timing oracle exploitation attempts
• Network traffic analysis showing repeated identical ciphertext submissions with different tags

Detection Strategies

• Monitor application logs for abnormal volumes of decryption failures from individual clients
• Implement rate limiting on endpoints that perform authenticated decryption operations
• Deploy network-level anomaly detection to identify timing attack patterns
• Review AWS-LC version deployed in production systems against vulnerable versions (< 1.69.0)

Monitoring Recommendations

• Enable verbose logging for cryptographic operations to track decryption request patterns
• Configure alerting for elevated rates of authentication tag validation failures
• Monitor network latency patterns to identify potential timing measurement activity
• Conduct periodic security audits of applications using AWS-LC EVP CIPHER APIs

How to Mitigate CVE-2026-3337

Immediate Actions Required

• Upgrade AWS-LC to version 1.69.0 or later immediately
• Audit all applications to identify usage of EVP_aes_128_ccm, EVP_aes_192_ccm, or EVP_aes_256_ccm
• Implement additional rate limiting on cryptographic operation endpoints as a defense-in-depth measure
• Review network architecture to minimize attacker ability to perform precise timing measurements

Patch Information

AWS has released AWS-LC version 1.69.0 which addresses this timing vulnerability with constant-time authentication tag comparison logic. The fix ensures that tag validation operations complete in the same time regardless of whether the tag is valid or invalid, eliminating the observable timing discrepancy.

For detailed patch information and release notes, refer to the GitHub Release v1.69.0 and the AWS Security Bulletin 2026-005. Additional technical details are available in the GitHub Security Advisory GHSA-frmv-5gcm-jwxh.

Note: AWS has stated that customers of AWS services do not need to take action, as AWS-managed infrastructure has been updated. Only applications directly using the AWS-LC library require updates.

Workarounds

• Consider using alternative authenticated encryption modes (AES-GCM) if upgrading AWS-LC is not immediately feasible
• Implement application-level timing noise to obscure actual decryption response times
• Deploy network-level jitter or rate limiting to reduce timing measurement precision
• Place vulnerable endpoints behind additional authentication to limit attacker access

# Verify AWS-LC version and upgrade
# Check current AWS-LC version in your application dependencies
grep -r "aws-lc" package.json requirements.txt go.mod Cargo.toml

# Update to patched version 1.69.0
# For applications using AWS-LC directly, update your dependency configuration
# to require version >= 1.69.0