RUSTSEC-2026-0046: PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

> PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `aws-lc-sys` |
| Version | `0.35.0` |
| URL | [https://aws.amazon.com/security/security-bulletins/2026-005-AWS](https://aws.amazon.com/security/security-bulletins/2026-005-AWS) |
| Date | 2026-03-02 |
| Patched versions | `>=0.38.0` |
| Unaffected versions | `<0.24.0` |

Improper certificate validation in `PKCS7_verify()` in AWS-LC allows an
unauthenticated user to bypass certificate chain verification when processing
PKCS7 objects with multiple signers, except the final signer.

Customers of AWS services do not need to take action. `aws-lc-sys` contains
code from AWS-LC. Applications using `aws-lc-sys` should upgrade to the most
recent release of `aws-lc-sys`.

There is no workaround; applications using `aws-lc-sys` should upgrade to the
most recent release of aws-lc-sys.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0046.html) for additional details.

Locate the dependency declaration for aws-lc-sys 0.35.0 and review how this Rust project resolves its dependencies. Update it to a patched version at or above 0.38.0, then run the project's existing checks to confirm the dependency upgrade succeeds and the application remains functional.

Written by the indexing model from the issue text.