CVE-2026-110310CWE-204CWE-757

CVE-2026-110310

Medium · published October 15, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
42.5
In the wild
Unconfirmed
What it is

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object.

To remediate this issue, we recommend that users upgrade to version 3.2.2 or 4.0.3. The 1.x and 2.x lines will not be patched, users of those lines need to migrate to 3.2.2 or 4.0.3.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
6.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00508 · 42.5th percentile
Weaknesses
CWE-204 · Observable Response Discrepancy; CWE-757 · Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
Published
2026-10-15T00:17Z
References (4)
https://aws.amazon.com/security/security-bulletins/2026-135-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/amazon-s3-encryption-client-dotnet/security/advisories/GHSA-322w-f6rw-r4fj · ff89ba41-3aa1-4d27-914a-91399e9639e5https://www.nuget.org/packages/Amazon.Extensions.S3.Encryption/3.2.2 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://www.nuget.org/packages/Amazon.Extensions.S3.Encryption/4.0.3 · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 16 OCT 03:27Z
    EPSS moved — → 1%
    epss
  • 14 OCT 19:37Z
    RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET
    cvelistv5
  • 14 OCT 19:37Z
    RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET
    cvelistv5