CVE-2026-47074 json
ex_aws_sns SigningCertURL not validated in verify_message/1
published 2026-05-28 5 mo ago modified 2026-10-26 14 d ago also EEF-CVE-2026-47074 , EUVD-2026-32861 , GHSA-8jgf-23q5-x7xx
- cvss
- 8.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 13%
- public exploits
- 0
- none known
Summary
Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCache modules) allows Signature Spoofing by Improper Validation.
This vulnerability is associated with program files lib/ex_aws/sns.ex, lib/ex_aws/sns/public_key_cache.ex and program routines 'Elixir.ExAws.SNS':verify_message/1, 'Elixir.ExAws.SNS.PublicKeyCache':get/1.
'Elixir.ExAws.SNS':verify_message/1 fetches the signing certificate from the SigningCertURL field of the incoming SNS message without validating that the URL uses HTTPS or that the host matches an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to an endpoint that calls verify_message/1 can supply an attacker-controlled SigningCertURL, sign a forged SNS message with their own key, and cause the function to return :ok, completely bypassing SNS signature verification.
This issue affects ex_aws_sns: from 2.0.1 before 2.3.5.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hex | ex_aws_sns | >=2.0.1, <2.3.5 |
2.3.5 |
Affected products
- ex-aws ex_aws_sns
Classification
- Weakness
-
- CWE-295 Improper Certificate Validation
References
-
github.com
/ex-aws/ex_aws_sns/commit/1853d280b152d10384a1e21a22cf22152a60be48
patch, web
-
github.com
/ex-aws/ex_aws_sns/security/advisories/GHSA-8jgf-23q5-x7xx
vendor-advisory, related, web, advisory
-
cna.erlef.org
/cves/CVE-2026-47074.html
related, web
-
osv.dev
/vulnerability/EEF-CVE-2026-47074
related, web
-
github.com
/benoitc/hackney/security/advisories/GHSA-jq4m-q6p2-8gwc
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-47074
advisory
-
github.com
/ex-aws/ex_aws_sns
package
-
hex.pm
/packages/ex_aws_sns
package
Sources
- CVE List CVE-2026-47074
- GitHub Advisory GHSA-8jgf-23q5-x7xx
- NVD CVE-2026-47074
- OSV EEF-CVE-2026-47074
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.