A logic flaw in the CRL distribution point validation routine of AWS‑LC before version 1.71.0 causes partitioned Certificate Revocation Lists to be incorrectly marked as out of scope. This flaw lets a revoked certificate succeed the revocation check, allowing an attacker to use a certificate that should be rejected. The weakness aligns with weaknesses that deny or bypass intended revocation logic and can lead to unauthorized access or man‑in‑the‑middle attacks when the revoked certificate is trusted by a client or server using AWS‑LC for validation.

The vulnerability impacts the AWS‑LC cryptographic library and its FIPS‑compliant variant AWS‑LC‑FIPS. All installations of these libraries at versions earlier than 1.71.0 for AWS‑LC or 3.3.0 for AWS‑LC‑FIPS are affected.

The flaw carries a high CVSS score of 9.1 and is deemed unlikely to be widely exploited, with an EPSS score below 1 %. It is not currently listed in the CISA KEV catalog. The primary exploitation pathway would involve an environment that relies on AWS‑LC to validate certificates, wherein an attacker could supply a revoked certificate that is incorrectly accepted, thereby bypassing revocation checks.