Cryptographic Key Commitment Flaw in Amazon S3 Encryption Client for Go
CVE-2025-14764

6MEDIUM

Key Information:

Vendor: Aws
Status: S3 Encryption Client For Go
Vendor: CVE Published:; 17 December 2025

What is CVE-2025-14764?

The Amazon S3 Encryption Client for Go contains a vulnerability related to missing cryptographic key commitment. This issue enables users with write access to the S3 bucket to introduce a new Encryption Data Key (EDK) that can decrypt to unexpected plaintext when the encrypted data key is stored in an 'instruction file' rather than in S3's metadata record. To protect against this vulnerability, users are advised to upgrade to version 3.3 or later of the Amazon S3 Encryption Client for Go.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch