A timing discrepancy exists in the AES‑CCM decryption process of AWS‑LC that allows an attacker to infer whether an authentication tag is valid by measuring decryption time. Because the tag verification step is conditioned on the authentication result, the observed latency leaks sensitive state, potentially allowing an attacker to infer authentication tag validity.

All versions of AWS‑LC and AWS‑LC‑FIPS that expose the EVP AES CCM APIs – specifically EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm – are impacted. The vulnerability is mitigated in AWS‑LC release 1.69.0 and later; earlier releases remain vulnerable.

The CVSS score of 8.2 classifies this as a high‑severity flaw, but the EPSS score of less than 1 % indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this weakness remotely by sending crafted ciphertexts to the decryption routine and timing responses. Detection of the vulnerability requires a side‑channel timing attack rather than code execution. The lack of an existing workaround means that patching is the only viable defense.