Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110310— RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET

Quick assessment

Affected
Amazon Amazon.Extensions.S3.Encryption
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

远程用户如果具备读取 S3 桶中加密对象的权限，可以通过将对象元数据中记录的填充方案篡改为传统的 PKCS#1 v1.5 填充方案，从而强制执行填充降级。由于 PKCS#1 v1.5 填充方案易受著名的 Bleichenbacher 攻击影响，攻击者可以利用 PKCS#1 v1.5 填充预言机（padding oracle）恢复由 RSA 包装的信封密钥，进而解密该对象。 为修复此问题，我们建议用户升级至版本 3.2.2 或 4.0.3。1.x 和 2.x 系列版本将不再进行补丁更新，这些系列的用户需要迁移至 3.

CVSS 5.3 · Medium EPSS 0.51% · P42

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 3

VendorProduct Version RangeStatus
Amazon Amazon.Extensions.S3.Encryption 2.1.0≤ 2.* affected
3.0.0≤ 3.2.1 affected
4.0.0≤ 4.0.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110310

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET
Source: CVE Program / CVE List V5
Vulnerability Description
A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object. To remediate this issue, we recommend that users upgrade to version 3.2.2 or 4.0.3. The 1.x and 2.x lines will not be patched, users of those lines need to migrate to 3.2.2 or 4.0.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
响应差异性信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Amazon Amazon.Extensions.S3.Encryption 2.1.0 ~ 2.* -

II. Public POCs for CVE-2026-110310

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110310

请登录查看更多情报信息。

Other References for CVE-2026-110310 (4)

IV. Related Vulnerabilities

Same vendor: Amazon
Same weakness: CWE-204

V. Comments for CVE-2026-110310

No comments yet

Leave a comment