Remote Padding Downgrade Vulnerability in Amazon S3 Encryption Client

CVE-2026-110310

What is CVE-2026-110310?

A security flaw allows a remote user to exploit encrypted objects stored in the Amazon S3 bucket by manipulating object metadata to enforce a transition to the outdated PKCS#1 v1.5 padding scheme. This scheme is vulnerable to the known Bleichenbacher attack, enabling the user to potentially recover the RSA-wrapped envelope key through a padding oracle attack, which could lead to unauthorized decryption of sensitive data. To address this issue, upgrading to version 3.2.2 or 4.0.3 is essential, as earlier versions (1.x and 2.x) will not receive patches and must be migrated to ensure security.

References