Answer in brief
CVE-2026-3337 records a Medium severity (CVSS 5.9) vulnerability in Timing Side-Channel in AES-CCM Tag Verification in AWS-LC. The current sources do not mark it as known exploited. The current feed maps aws-lc-fips-sys (crates.io), aws-lc-sys (crates.io). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps aws-lc-fips-sys (crates.io), aws-lc-sys (crates.io). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| aws-lc-fips-syscrates.io | >=0.13.0 <0.13.12 | 0.13.12 |
| aws-lc-syscrates.io | >=0.14.0 <0.38.0 | 0.38.0 |
Published upstream
Mar 2, 2026
Evidence: source:osv:source_dates:source-dates:recordSource modified
Nov 9, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Nov 9, 2026
Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: `EVP_aes_128_ccm`, `EVP_aes_192_ccm`, and `EVP_aes_256_ccm`. Customers of AWS services do not need to take action. `aws-lc-fips-sys` contains code from AWS-LC. Applications using `aws-lc-fips-sys` should upgrade to the most recent release of `aws-lc-fips-sys`. ## Workarounds In the special cases of using AES-CCM with (M=4, L=2), (M=8, L=2), or (M=16, L=2), applications can workaround this issue by using AES-CCM through the EVP AEAD API using implementations `EVP_aead_aes_128_ccm_bluetooth`, `EVP_aead_aes_128_ccm_bluetooth_8`, and `EVP_aead_aes_128_ccm_matter` respectively. Otherwise, there is no workaround and applications using `aws-lc-fips-sys` should upgrade to the most recent release of `aws-lc-fips-sys`.
Quoted source text, attributed separately from HOL analysis.