CVE-2025-14764 Details
Description
Missing cryptographic key commitment in the Amazon S3 Encryption Client for Go may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgrade Amazon S3 Encryption Client for Go to version 4.0 or later.
A key commitment vulnerability has been identified in the Amazon S3 Encryption Client for Go, specifically in versions through 3.1.0. This vulnerability allows a user with write access to an S3 bucket to replace the encrypted data key (EDK) with a rogue key that decrypts to a different plaintext. This issue arises when the EDK is stored in an 'Instruction File' rather than in S3's metadata, exposing it to an 'Invisible Salamanders' attack. The lack of key commitment means that a single ciphertext could be decrypted into multiple plaintexts using different keys, potentially leading to unauthorized access to sensitive data.
Users are advised to upgrade the Amazon S3 Encryption Client for Go to version 4.0.0 or later, where this vulnerability has been addressed by introducing key commitment, ensuring that the EDK is cryptographically bound to the ciphertext. Instructions for upgrading can be found in the migration guide from version 3.x to 4.x.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 17, 2025CISA-ADP
Assessed Dec 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://aws.amazon.com/security/security-bulletins/AWS-2025-032/ | AMZN | AdvisoryBundleRemedyVendor |
| https://github.com/aws/amazon-s3-encryption-client-go/releases/tag/v4.0.0 | AMZN | Release NotesVendor |
| https://github.com/aws/amazon-s3-encryption-client-go/security/advisories/GHSA-3g75-q268-r9r6 | AMZN | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | AMZN |
Affected Products
| Product | Versions |
|---|---|
| Amazon S3 Encryption Client | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | AMZN |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 17, 2025 | CVE Modified | AMZN |
| Dec 17, 2025 | New CVE Received | AMZN |