Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-16317— Silent Drop of TLS 1.3 Encrypted Records in s2n-tls

Quick assessment

Affected
AWS s2n-tls
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Amazon s2n-tls是美国Amazon公司开源的一款TLS协议实现库。 Amazon s2n-tls 1.7.5及之前版本存在加密问题漏洞，该漏洞源于TLS 1.3加密记录中缺少对外部content_type字节的验证，将application_data硬编码到附加认证数据中，使其不受认证标签保护，可能导致活跃的中间人攻击者静默丢弃单个应用数据记录，在HTTP管道化场景中造成请求/响应失同步，或在高写入工作负载中导致未检测到的数据丢失。

CVSS 6.5 · Medium EPSS 0.25% · P14

Possible ATT&CK Techniques 1 AI

T1557.002 · ARP Cache Poisoning

Affected Version Matrix 1

VendorProduct Version RangeStatus
AWS s2n-tls ≤ 1.7.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-16317

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Silent Drop of TLS 1.3 Encrypted Records in s2n-tls
Source: CVE Program / CVE List V5
Vulnerability Description
Missing validation of the outer content_type byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer content_type of all encrypted TLS 1.3 records must be application_data (0x17). The s2n-tls AEAD implementation hardcodes this value in the additional authenticated data rather than using the actual wire byte, so the outer content_type is not covered by the authentication tag. This enables selective suppression of application data. In HTTP pipelining scenarios, dropping a TLS record containing an HTTP request can cause request/response desynchronization, where subsequent responses are delivered to the wrong requests. In write-heavy workloads, a dropped record containing a write request can result in undetectable data loss when the client interprets a subsequent success response as confirmation of the dropped write. All TLS 1.3 connections are affected. Both TLS clients and servers are affected. TLS 1.2 and QUIC connections are not affected. We recommend you upgrade s2n-tls to version v1.7.6
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
完整性检查值验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Amazon s2n-tls 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Amazon s2n-tls是美国Amazon公司开源的一款TLS协议实现库。 Amazon s2n-tls 1.7.5及之前版本存在加密问题漏洞，该漏洞源于TLS 1.3加密记录中缺少对外部content_type字节的验证，将application_data硬编码到附加认证数据中，使其不受认证标签保护，可能导致活跃的中间人攻击者静默丢弃单个应用数据记录，在HTTP管道化场景中造成请求/响应失同步，或在高写入工作负载中导致未检测到的数据丢失。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
AWS s2n-tls 0 ~ 1.7.5 -

II. Public POCs for CVE-2026-16317

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-16317

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-16317 (3)

IV. Related Vulnerabilities

Same product: s2n-tls
Same vendor: AWS
Same weakness: CWE-354

V. Comments for CVE-2026-16317

No comments yet

Leave a comment