Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-110310 Details

Description

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object. To remediate this issue, we recommend that users upgrade to version 3.2.2 or 4.0.3. The 1.x and 2.x lines will not be patched, users of those lines need to migrate to 3.2.2 or 4.0.3.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: AMZNCVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://aws.amazon.com/security/security-bulletins/2026-135-aws/	AMZN
https://github.com/aws/amazon-s3-encryption-client-dotnet/security/advisories/GHSA-322w-f6rw-r4fj	AMZN
https://www.nuget.org/packages/Amazon.Extensions.S3.Encryption/3.2.2	AMZN
https://www.nuget.org/packages/Amazon.Extensions.S3.Encryption/4.0.3	AMZN

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-204	Observable Response Discrepancy	AMZN
CWE-757	Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')	AMZN

Affected Products

No affected product data is available for this CVE.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 14, 2026	New CVE Received	AMZN
Oct 14, 2026	CVE Modified	CISA-ADP