RUSTSEC-2026-0046: PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

[github-actions]

Details
Package	aws-lc-sys
Version	0.37.0
URL	https://aws.amazon.com/security/security-bulletins/2026-005-AWS
Patched Versions	>=0.38.0
Unaffected Versions	<0.24.0
Aliases	CVE-2026-3336, GHSA-cfwj-9wp5-wqvp, GHSA-vw5v-4f2q-w9xf

Improper certificate validation in PKCS7_verify() in AWS-LC allows an
unauthenticated user to bypass certificate chain verification when processing
PKCS7 objects with multiple signers, except the final signer.

Customers of AWS services do not need to take action. aws-lc-sys contains
code from AWS-LC. Applications using aws-lc-sys should upgrade to the most
recent release of aws-lc-sys.

There is no workaround; applications using aws-lc-sys should upgrade to the
most recent release of aws-lc-sys.