CVE-2026-3337

CVE-2026-3337 is a medium-severity timing side-channel vulnerability in AWS-LC's AES-CCM decryption, specifically impacting implementations using the EVP CIPHER API (EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm). An unauthenticated attacker can potentially determine the validity of authentication tags through timing analysis. The CVSS score is 5.9, indicating a network attack vector with high attack complexity and a high impact on integrity, though confidentiality and availability are not affected. There is no evidence of active exploitation, public exploit code, or Metasploit/Nuclei modules, but it has garnered some community discussion and media coverage. Customers using AWS services are not impacted, but applications directly using AWS-LC should upgrade to version 1.69.0.