Skip to main content

Key Commitment Issues in S3 Encryption Clients

Posted on: Dec 17, 2025

Bulletin ID: AWS-2025-032
Scope:  AWS
Content Type:  Important (requires attention)
Publication Date: 2025/12/17 12:15 PM PST


We identify the following CVEs:

  • CVE-2025-14763 - Key Commitment Issues in S3 Encryption Client in Java
  • CVE-2025-14764 - Key Commitment Issues in S3 Encryption Client in Go
  • CVE-2025-14759 - Key Commitment Issues in S3 Encryption Client in .NET
  • CVE-2025-14760 - Key Commitment Issues in S3 Encryption Client in C++ (part of the AWS SDK for C++)
  • CVE-2025-14761 - Key Commitment Issues in S3 Encryption Client in PHP (part of the AWS SDK for PHP)
  • CVE-2025-14762 - Key Commitment Issues in S3 Encryption Client in Ruby (part of the AWS SDK for Ruby)

Description:

S3 Encryption Clients for Java, Go, .NET, C++, PHP, and Ruby are open-source client-side encryption libraries used to facilitate writing and reading encrypted records to S3.

When the encrypted data key (EDK) is stored in an "Instruction File" instead of S3's metadata record, the EDK is exposed to an "Invisible Salamanders" attack, which could allow the EDK to be replaced with a new key.

Affected versions: 

  • S3 Encryption Client Java: <= 3.5.0
  • S3 Encryption Client Go: <= 3.1.0
  • S3 Encryption Client .NET: <= 3.1
  • AWS SDK for C++: <= 1.11.711
  • AWS SDK for PHP: <= 3.367.0
  • AWS SDK for Ruby: <= 1.207.0

Resolution:

We are introducing the concept of "key commitment" to S3EC where the EDK is cryptographically bound to the ciphertext in order to address this issue. In order to maintain compatibility for in-flight messages we are releasing the fix in two versions. A code-compatible minor version that can read messages with key-commitment but not write them, and a new major version that can both read and write messages with key-commitment. We recommend customers upgrade to the latest major version.

Workarounds:

There are no known workarounds.

References:


Please email aws-security@amazon.com with any security questions or concerns.