github.com/google/comprehensive-rust
Submitted 8/4/2026, 10:28:01 AM · Status: ok
Risk grade
F
100 / 100
Findings
165
0 critical10 high26 medium0 low129 info0 on CISA KEV0ATT&CK
Showing 165 of 165 findings
Findings
- AWS-LC has PKCS7_verify Certificate Chain Validation Bypassgrype
- AWS-LC has PKCS7_verify Signature Validation Bypassgrype
- AWS-LC has Timing Side-Channel in AES-CCM Tag Verificationgrype
- AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CNgrype
- CRL Distribution Point Scope Check Logic Error in AWS-LCgrype
- AWS-LC has PKCS7_verify Certificate Chain Validation Bypass### Summary AWS-LC is an open-source, general-purpose cryptographic library. ### Impact Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except…trivy
- AWS-LC has PKCS7_verify Signature Validation Bypass### Summary AWS-LC is an open-source, general-purpose cryptographic library. ### Impact Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Custome…trivy
- AWS-LC has Timing Side-Channel in AES-CCM Tag Verification### Summary AWS-LC is an open-source, general-purpose cryptographic library. ### Impact Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementa…trivy
- AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN### Summary AWS-LC is an open-source, general-purpose cryptographic library. ### Impact A logic error in CN (Common Name) validation allows certificates with wildcard or raw UTF-8 Unicode CN values to bypass name constraints enforcement. The `cn2dnsid` function does not recogn…trivy
- CRL Distribution Point Scope Check Logic Error in AWS-LC### Summary AWS-LC is an open-source, general-purpose cryptographic library. ### Impact A logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking…trivy
This report is public.