CVE-2026-110310 Amazon CVE debrief

Who should care

Defenders of Amazon S3 Encryption Client for .NET systems, particularly those using 1.x, 2.x, 3.x, and 4.x versions prior to 3.2.2 or 4.0.3, should assess exposure and prioritize remediation.

Why it matters

Defenders should care about CVE-2026-110310 because it allows a remote user to decrypt encrypted objects in an S3 bucket by exploiting a padding oracle vulnerability in the Amazon S3 Encryption Client for .NET. This can lead to unauthorized data access and potential data breaches. Affected systems should be identified and remediated by upgrading to version 3.2.2 or 4.0.3.

• Decrypting encrypted objects without authorization
• Potential data breaches due to unauthorized access
• Compromised data integrity due to padding oracle attacks
• Need for verification of affected systems and remediation

Technical summary

A remote user can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5, allowing them to use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object. The Amazon S3 Encryption Client for .NET is susceptible to this vulnerability, particularly in versions prior to 3.2.2 or 4.0.3. This vulnerability can be mitigated by upgrading to version 3.2.2 or 4.0.3. Users of 1.x and 2.x lines need to migrate to 3.2.2 or 4.0.3. The CVE record and source item provide details on the vulnerability, including the affected versions and recommended remediation.

Defensive priority

Upgrade to version 3.2.2 or 4.0.3 to remediate this issue. Users of 1.x and 2.x lines need to migrate to 3.2.2 or 4.0.3.

Recommended defensive actions

• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Upgrade to version 3.2.2 or 4.0.3

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected versions and recommended remediation. A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. This padding scheme is susceptible to the well-known Bleichenbacher attack, allowing the user to use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object. Evidence limits suggest verifying the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.