CVE-2026-4428

A logic error exists in the CRL distribution point validation module that causes partitioned CRL lists to be improperly classified as out of scope and rejected. Consequently, the library treats certificates covered by such lists as unchecked for revocation instead of rejecting them. An attacker possessing a revoked certificate can exploit this error to effectively bypass the certificate status verification mechanism.

An attacker possessing a certificate that should be revoked can effectively use it for authentication or establishing encrypted connections, bypassing PKI security measures. This may lead to unauthorized access to resources protected by certificate verification mechanisms and compromise the confidentiality and integrity of data.

AWS-LC should be updated to version 1.71.0 or later, and in case of the FIPS variant to AWS-LC-FIPS-3.3.0 or later. Details are available in the AWS security bulletin (https://aws.amazon.com/security/security-bulletins/2026-010-AWS/) and in release notes on GitHub.

AWS-LC before version 1.71.0 and AWS-LC-FIPS before version 3.3.0. Affects all applications and systems using these libraries for certificate validation with partitioned CRL lists.