CVE-2026-110310 - RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET
Amazon S3 ยท 2026-10-14
Actions
Technical Details
| Affected Versions | >= 2.1.0, 3.0.0 to 3.2.1, 4.0.0 to 4.0.2 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-110310 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update the Amazon S3 Encryption Client for.NET to version 3.2.2 or 4.0.3 to address the CVE-2026-110310 vulnerability and ensure secure encryption of S3 objects.
For Platform Teams
Deploy the patched Amazon S3 Encryption Client for.NET to maintain secure data encryption and protect against potential padding oracle attacks.
For Executives
Implement the latest Amazon S3 Encryption Client for .NET to mitigate the risk of data breaches due to the identified vulnerability, ensuring data security and integrity.
Source
Related Amazon S3 Updates
- Amazon S3 is now available on the Vercel Marketplace and v0 by Vercel (2026-10-14)
- Amazon S3 Vectors metadata pre-filtering is now available in AWS GovCloud (US) Regions (2026-10-09)
- Introducing File Mover Express: Open source, high-performance file transfer to Amazon S3 for media workflows (2026-10-08)
- Amazon S3 Object Lock variable retention with event holds is now available in AWS GovCloud (US) Regions (2026-10-01)
- Amazon S3 Vectors now supports metadata pre-filtering for higher recall on filtered searches (2026-09-30)