{"id":"GHSA-322w-f6rw-r4fj","kind":"vulnerability","aliases":["GHSA-322w-f6rw-r4fj"],"related":[],"title":"CVE-2026-110310 - RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET","description":"CVE-2026-110310 - RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET\n\n### CVE-2026-110310 - RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET\n\nBulletin ID: 2026-135-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/14/2026 12:30 PM PDT\n\nDescription:\n\nWe identified CVE-2026-110310, an issue in Amazon S3 encryption client for .NET that could allow a remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object.\n\nImpacted versions: >= 2.1.0; 3.0.0 to 3.2.1; 4.0.0 to 4.0.2\n\nResolution:\n\nThis issue has been addressed in Amazon S3 Encryption Client for .NET version 3.2.2 for customers on version 3.x and version 4.0.3 for customers on version 4.x. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. The 1.x and 2.x lines will not receive patches; users of those versions need to migrate to version 3.2.2 or 4.0.3.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-110310\n- GHSA-322w-f6rw-r4fj\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The Amazon S3 Encryption Client for .NET can be tricked into switching an object's RSA key wrapping to legacy PKCS#1 v1.5 padding, which is open to Bleichenbacher padding-oracle attacks. A remote user who can read encrypted objects in the bucket could recover the envelope key and decrypt the object.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","client-side-encryption","csharp","dotnet","lab-disclosure","package","s3"],"not_affected_if":["fixed-version","not-using-s3-encryption-client"],"how_to_check":"- Check the installed `AWSSDK.S3Encryption` or Amazon S3 Encryption Client package version in the project's .csproj or packages.lock.json, and look for versions `>= 2.1.0`, `3.0.0` to `3.2.1`, or `4.0.0` to `4.0.2`.\n- Run `dotnet list package` in each .NET solution to list the resolved version.\n- Check for forked or vendored copies of the encryption client code that were not updated.","fix":"- Upgrade 3.x installs to `3.2.2` or later.\n- Upgrade 4.x installs to `4.0.3` or later.\n- Migrate any 1.x or 2.x installs to `3.2.2` or `4.0.3`, since those lines will not be patched.\n- Patch any forked or derivative code with the new fixes.","status":"open","published_at":"2026-10-14T00:00:00+00:00","first_seen_at":"2026-10-24T20:05:35+00:00","triaged_at":"2026-10-25T05:27:52+00:00","updated_at":"2026-10-25T05:27:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T05:27:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade 3.x installs to `3.2.2` or later.\n- Upgrade 4.x installs to `4.0.3` or later.\n- Migrate any 1.x or 2.x installs to `3.2.2` or `4.0.3`, since those lines will not be patched.\n- Patch any forked or derivative code with the new fixes.","reach":"network","title":"Amazon S3 Encryption Client for .NET: padding downgrade enables RSA key recovery","impact":"high","summary":"The Amazon S3 Encryption Client for .NET can be tricked into switching an object's RSA key wrapping to legacy PKCS#1 v1.5 padding, which is open to Bleichenbacher padding-oracle attacks. A remote user who can read encrypted objects in the bucket could recover the envelope key and decrypt the object.","category":"package","nicknames":[],"who_cares":["aws","s3","dotnet","csharp","client-side-encryption"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker recovers envelope key and decrypts stored S3 objects","analyst_note":"Check the AWS bulletin 2026-135-AWS and the GHSA page for whether the attacker must already hold read access and whether specific bucket configurations change exposure.","how_to_check":"- Check the installed `AWSSDK.S3Encryption` or Amazon S3 Encryption Client package version in the project's .csproj or packages.lock.json, and look for versions `>= 2.1.0`, `3.0.0` to `3.2.1`, or `4.0.0` to `4.0.2`.\n- Run `dotnet list package` in each .NET solution to list the resolved version.\n- Check for forked or vendored copies of the encryption client code that were not updated.","needs_analyst":true,"not_affected_if":["fixed-version","not-using-s3-encryption-client"],"who_is_affected":"Applications using the Amazon S3 Encryption Client for .NET with the affected version ranges that read client-side encrypted objects from S3 buckets. The attacker needs the ability to read or modify the object's metadata, which the sources describe as a remote user who can read encrypted objects in the bucket. Teams not using this client library, or already on the fixed versions, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000804,"input_tokens":3965,"output_tokens":815,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110310':3A,100C,122C,166C,332C '-135':145C '-2026':2A,99C,121C,165C,331C '1':6A,66B,103C,125C,210C,228C,305C '10/14/2026':156C '12':157C '2':308C '2.1.0':246C '2026':144C '3':272C '3.0.0':247C '3.2.1':249C '3.2.2':267C,324C '30':158C '322w':25A,30A,335C '4':281C '4.0.0':250C '4.0.2':252C '4.0.3':276C,326C 'address':258C 'allow':178C 'alter':197C 'amazon':17A,46B,114C,136C,170C,260C 'attack':77B,221C 'attent':153C 'aw':33B,146C,148C 'aws-security@amazon.com':340C 'bleichenbach':73B,220C 'bucket':88B,190C 'bulletin':142C 'client':20A,35B,49B,117C,139C,173C,263C 'client-side-encrypt':34B 'code':296C 'concern':346C 'content':149C 'could':89B,177C 'csharp':38B 'custom':269C,278C 'cve':1A,98C,120C,164C,330C 'date':155C 'decrypt':95B,241C 'deriv':295C 'descript':161C 'disclosur':42B 'dotnet':39B 'downgrad':15A,112C,134C,195C 'email':339C 'encrypt':19A,37B,48B,84B,116C,138C,172C,185C,262C 'ensur':291C 'envelop':12A,92B,109C,131C,238C 'f6rw':26A,31A,336C 'fix':303C 'forc':192C 'fork':293C 'format':14A,111C,133C 'ghsa':24A,29A,334C 'ghsa-322w-f6rw-r4fj':23A,28A,333C 'id':143C 'identifi':163C 'impact':244C 'import':151C 'incorpor':300C 'issu':168C,255C 'key':13A,61B,93B,110C,132C,239C 'lab':41B 'lab-disclosur':40B 'latest':288C 'legaci':11A,64B,108C,130C,208C 'line':310C 'metadata':206C 'migrat':321C 'need':319C 'net':22A,51B,119C,141C,175C,265C 'new':302C 'none':328C 'object':58B,85B,97B,186C,204C,243C 'open':71B 'oracl':9A,76B,106C,128C,231C 'packag':43B 'pad':8A,68B,75B,105C,127C,194C,199C,214C,230C 'padding-oracl':74B 'patch':298C,314C 'pdt':160C 'pkcs':5A,65B,102C,124C,209C,227C 'pleas':338C 'pm':159C 'public':154C 'question':344C 'r4fj':27A,32A,337C 'read':83B,184C 'receiv':313C 'recommend':284C 'record':201C 'recov':90B,233C 'refer':329C 'remot':79B,180C 'requir':152C 'resolut':253C 'rsa':4A,60B,101C,123C,236C 'rsa-wrap':235C 's3':18A,44B,47B,115C,137C,171C,189C,261C 'scheme':200C,215C 'scope':147C 'secur':343C 'side':36B 'sinc':212C 'suscept':217C 'switch':56B 'trick':54B 'type':150C 'upgrad':285C 'use':225C 'user':80B,181C,223C,315C 'v1.5':7A,67B,104C,126C,211C,229C 'version':245C,266C,271C,275C,280C,289C,318C,323C 'via':10A,107C,129C 'workaround':327C 'wrap':62B,237C 'x':273C,282C,306C,309C","nicknames":[],"mitigations":[],"who_affected":"Applications using the Amazon S3 Encryption Client for .NET with the affected version ranges that read client-side encrypted objects from S3 buckets. The attacker needs the ability to read or modify the object's metadata, which the sources describe as a remote user who can read encrypted objects in the bucket. Teams not using this client library, or already on the fixed versions, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-14T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-135-aws/#GHSA-322w-f6rw-r4fj","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-135-aws/","severity":null,"published_at":"2026-10-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T20:05:35+00:00","fetched_at":"2026-10-25T09:45:23+00:00","note":"AWS: CVE-2026-110310 - RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET"}],"documents":[{"id":2970,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-135-aws/","title":"AWS: CVE-2026-110310 - RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET","kind":"advisory","source":"lab","text":"CVE-2026-110310 - RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET\n\n### CVE-2026-110310 - RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET\n\nBulletin ID: 2026-135-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/14/2026 12:30 PM PDT\n\nDescription:\n\nWe identified CVE-2026-110310, an issue in Amazon S3 encryption client for .NET that could allow a remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object.\n\nImpacted versions: >= 2.1.0; 3.0.0 to 3.2.1; 4.0.0 to 4.0.2\n\nResolution:\n\nThis issue has been addressed in Amazon S3 Encryption Client for .NET version 3.2.2 for customers on version 3.x and version 4.0.3 for customers on version 4.x. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. The 1.x and 2.x lines will not receive patches; users of those versions need to migrate to version 3.2.2 or 4.0.3.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-110310\n- GHSA-322w-f6rw-r4fj\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-14T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}