Live › vulnerability › CVE-2026-110310
Go to dashboardThe Amazon S3 Encryption Client for .NET can be tricked into using legacy RSA PKCS#1 v1.5 padding by editing an object's metadata, which enables a Bleichenbacher padding oracle attack. A remote user who can read the encrypted objects in the bucket can use this to recover the RSA-wrapped envelope key and decrypt the object.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 20:05 UTC, 0h before NVD. All times on this page are UTC.
Applications that use the Amazon S3 Encryption Client for .NET to encrypt objects stored in S3 are exposed. The attack needs the ability to write object metadata for encrypted objects, so the bucket permissions and who can write to it matter. Teams that do not use this client on .NET, or that already run 3.2.2, 4.0.3 or later, can skip it.
No product ranges from the sources yet.
AWS.Encryption.SDK or AmazonS3EncryptionClient package version in the .csproj or packages.lock.json; affected: >= 2.1.0, 3.0.0 to 3.2.1, 4.0.0 to 4.0.23.2.2 or the 4.x line to 4.0.33.2.2 or 4.0.3, since those lines will not receive patchesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-110310 - RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET
Bulletin ID: 2026-135-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/14/2026 12:30 PM PDT
Description:
We identified CVE-2026-110310, an issue in Amazon S3 encryption client for .NET that could allow a remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object.
Impacted versions: >= 2.1.0; 3.0.0 to 3.2.1; 4.0.0 to 4.0.2
Resolution:
This issue has been addressed in Amazon S3 Encryption Client for .NET version 3.2.2 for customers on version 3.x and version 4.0.3 for customers on version 4.x. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. The 1.x and 2.x lines will not receive patches; users of those versions need to migrate to version 3.2.2 or 4.0.3.
Workarounds:
None.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-110310")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.