Bulletin ID: 2026-135-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/14/2026 12:30 PM PDT

Description:

We identified CVE-2026-110310, an issue in Amazon S3 encryption client for .NET that could allow a remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object.

Impacted versions: >= 2.1.0; 3.0.0 to 3.2.1; 4.0.0 to 4.0.2

Resolution:

This issue has been addressed in Amazon S3 Encryption Client for .NET version 3.2.2 for customers on version 3.x and version 4.0.3 for customers on version 4.x. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. The 1.x and 2.x lines will not receive patches; users of those versions need to migrate to version 3.2.2 or 4.0.3.

Workarounds:

None.

References:

• CVE-2026-110310
• GHSA-322w-f6rw-r4fj

Please email aws-security@amazon.com with any security questions or concerns.