Advisoriesby IbisRSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3...
Bulletin ID: 2026-135-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/14/2026 12:30 PM PDT Description: We identified CVE-2026-110310, an issue in Amazon S3 encryption client for .NET that could allow a remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object. Impacted versions: >= 2.1.0; 3.0.0 to 3.2.1; 4.0.0 to 4.0.2 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Affected versions
Changes since it was listed
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- NVD
More AWS advisories
All AWS
Allocation of resources without limits in the default aws-smithy-http-server serve() path...CVE-2026-16756no fix yetCredential disclosure in Strands Agents Tools elasticsearch_memory toolCVE-2026-15746no fix yetIssues with s2n-tls: an open-source implementation of the TLS/SSL protocolsCVE-2026-16317no fix yetSensitive content disclosure via OpenTelemetry spans in AgentCore Python SDKCVE-2026-15737no fix yetPath traversal and arbitrary file write in the workflow linters of...CVE-2026-15415no fix yetOS command injection in jsii-diff in AWS jsiiCVE-2026-15895no fix yet