CVE-2026-4428: AWS-LC Auth Bypass Vulnerability

CVE-2026-4428 Overview

A logic error in Certificate Revocation List (CRL) distribution point validation exists in AWS-LC, Amazon's cryptographic library. This vulnerability causes partitioned CRLs to be incorrectly rejected as out of scope, which allows revoked certificates to bypass certificate revocation checks. The flaw undermines the integrity of PKI validation processes, potentially enabling attackers to use revoked certificates for malicious purposes including impersonation and man-in-the-middle attacks.

Critical Impact

Revoked certificates can bypass validation checks, allowing attackers to use compromised or invalidated certificates for authentication, code signing, or encrypted communications.

Affected Products

• AWS-LC versions prior to 1.71.0
• AWS-LC-FIPS versions prior to 3.3.0
• Applications and services built using vulnerable AWS-LC libraries

Discovery Timeline

• 2026-03-19 - CVE-2026-4428 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-4428

Vulnerability Analysis

This vulnerability is classified under CWE-299 (Improper Check for Certificate Revocation), indicating a fundamental flaw in how the cryptographic library validates certificate revocation status. The logic error specifically affects the handling of partitioned CRLs, which are used by certificate authorities to distribute revocation information across multiple CRL files to improve scalability.

When processing partitioned CRLs, the AWS-LC library incorrectly determines that valid CRL distribution points are "out of scope," causing it to skip revocation checks entirely. This allows certificates that have been legitimately revoked to pass validation, effectively negating the security guarantees provided by the PKI revocation infrastructure.

The network-based attack vector means this vulnerability can be exploited remotely without authentication, though exploitation requires specific conditions where partitioned CRLs are in use and the attacker possesses a revoked certificate.

Root Cause

The root cause is a logic error in the CRL distribution point validation code within AWS-LC. When evaluating whether a CRL applies to a given certificate, the library uses incorrect scope determination logic for partitioned CRL scenarios. This causes legitimate CRL entries that should apply to the certificate being validated to be incorrectly classified as not applicable, resulting in the revocation check being bypassed.

Attack Vector

An attacker exploiting CVE-2026-4428 would need to possess a certificate that has been revoked but was previously issued by a trusted certificate authority. The attack proceeds as follows:

1. The attacker obtains or already possesses a certificate that has been legitimately revoked by the issuing CA
2. The CA publishes revocation information using partitioned CRLs
3. When a vulnerable AWS-LC client validates the attacker's certificate, it incorrectly rejects the applicable CRL partition as out of scope
4. The revoked certificate passes validation, allowing the attacker to authenticate, establish TLS connections, or sign code as if the certificate were still valid

This attack is particularly dangerous in scenarios involving mutual TLS authentication, code signing verification, or any application that relies on certificate revocation checking to reject compromised credentials.

Detection Methods for CVE-2026-4428

Indicators of Compromise

• Unexpected successful authentication using certificates that should have been revoked
• TLS connections established with certificates that appear on published CRLs
• Audit logs showing certificate validations succeeding without corresponding CRL checks
• Anomalous behavior from entities whose certificates were previously revoked

Detection Strategies

• Audit AWS-LC library versions deployed across infrastructure to identify instances running versions prior to 1.71.0
• Implement secondary certificate validation mechanisms that cross-check against OCSP responders
• Monitor for connections using certificates that match entries in known CRL publications
• Enable verbose logging for certificate validation operations to detect missing revocation checks

Monitoring Recommendations

• Deploy network monitoring to track TLS certificate usage and correlate with CRL databases
• Implement alerting for certificate validation events where CRL checks are skipped or fail
• Regularly audit cryptographic library versions across all applications and services
• Consider implementing certificate transparency log monitoring for your organization's certificates

How to Mitigate CVE-2026-4428

Immediate Actions Required

• Upgrade AWS-LC to version 1.71.0 or later immediately
• For FIPS-compliant environments, upgrade to AWS-LC-FIPS version 3.3.0 or later
• Audit all applications and services using AWS-LC to identify affected deployments
• Consider temporarily implementing OCSP checking as an additional revocation validation layer

Patch Information

AWS has released patched versions that correct the logic error in CRL distribution point validation. Users should upgrade to AWS-LC 1.71.0 or AWS-LC-FIPS 3.3.0 to remediate this vulnerability. Detailed release information is available in the GitHub AWS-LC Release v1.71.0 and the AWS Security Bulletin 2026-010.

Workarounds

• Enable OCSP (Online Certificate Status Protocol) checking in addition to CRL validation as a defense-in-depth measure
• Implement application-level certificate pinning for critical connections to reduce reliance on revocation checking
• Deploy network-level controls to block connections from known-revoked certificate fingerprints
• Consider using certificate transparency monitoring to detect usage of revoked certificates

# Configuration example
# Verify AWS-LC version in your environment
# Check the installed AWS-LC version
aws-lc version

# Update AWS-LC using your package manager or build system
# Example: rebuilding application with updated AWS-LC
cmake -DAWS_LC_VERSION=1.71.0 ..
make && make install

# Verify the update was successful
aws-lc version