Medium severity · published Oct 14, 2026
CVE-2026-110310
RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object.
To remediate this issue, we recommend that users upgrade to version 3.2.2 or 4.0.3. The 1.x and 2.x lines will not be patched, users of those lines need to migrate to 3.2.2 or 4.0.3.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Amazon.Extensions.S3.Encryption · Amazon
2.1.0 through 2.*; 3.0.0 through 3.2.1; 4.0.0 through 4.0.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110310
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110310
aws.amazon.com
https://aws.amazon.com/security/security-bulletins/2026-135-aws/
github.com
https://github.com/aws/amazon-s3-encryption-client-dotnet/security/advisories/GHSA-322w-f6rw-r4fj
www.nuget.org
https://www.nuget.org/packages/Amazon.Extensions.S3.Encryption/3.2.2
www.nuget.org
https://www.nuget.org/packages/Amazon.Extensions.S3.Encryption/4.0.3