CVE-2025-14763CWE-327

Missing cryptographic key commitment in the Amazon S3 Encryption Client for Java may allow a user with write access to the S3 bucket to introduce a new EDK…

Medium · published December 17, 2025

CVSS v4.0
6.0
EPSS
0%
Percentile
1.6
In the wild
Unconfirmed
What it is

Missing cryptographic key commitment in the Amazon S3 Encryption Client for Java may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record.

To mitigate this issue, upgrade Amazon S3 Encryption Client for Java to version 4.0.0 or later.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00118 · 1.6th percentile
Weakness
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2025-12-17T20:18Z
EPSS history
Timeline
  • 17 DEC 20:18Z
    Missing cryptographic key commitment in the Amazon S3 Encryption Client for Java may allow a user with write access to the S3 bucket to introduce a new EDK…
    cvelistv5