CVE-2026-47074
Description
Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCache modules) allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/ex_aws/sns.ex, lib/ex_aws/sns/public_key_cache.ex and program routines 'Elixir.ExAws.SNS':verify_message/1, 'Elixir.ExAws.SNS.PublicKeyCache':get/1. 'Elixir.ExAws.SNS':verify_message/1 fetches the signing certificate from the SigningCertURL field of the incoming SNS message without validating that the URL uses HTTPS or that the host matches an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to an endpoint that calls verify_message/1 can supply an attacker-controlled SigningCertURL, sign a forged SNS message with their own key, and cause the function to return :ok, completely bypassing SNS signature verification. This issue affects ex_aws_sns: from 2.0.1 before 2.3.5.
How to fix
- ex_aws_sns_project ex_aws_sns2.3.5, 1853d280b152d10384a1e21a22cf22152a60be48 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ex_aws_sns_project ex_aws_sns | 2.0.1 ≤ v < 2.3.5, a7ec21880943f4dac1d59bda557db0ffcd2b61fa ≤ v < 1853d280b152d10384a1e21a22cf22152a60be48 | 2.3.5, 1853d280b152d10384a1e21a22cf22152a60be48 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.