AWS S3 Encryption Client Flaw Allows Data Decryption via Padding Downgrade

Organisations using the Amazon S3 Encryption Client for .NET face a data exposure risk due to a vulnerability identified on 14 October 2026. The flaw, tracked as CVE-2026-110310, allows remote users with read access to encrypted objects to decrypt them. This issue impacts businesses relying on .NET applications to manage secure storage in AWS environments.

The risk

The vulnerability exploits a weakness in how the client handles encryption metadata. An attacker with read permissions can modify the padding scheme recorded in an object's metadata. This alteration forces a downgrade to the legacy PKCS#1 v1.5 format. According to the AWS Security Bulletin, this legacy scheme is susceptible to the Bleichenbacher attack.

By leveraging a PKCS#1 v1.5 padding oracle, an attacker can recover the RSA-wrapped envelope key. This key recovery enables the decryption of the stored object. The threat requires only read access to the bucket, not administrative privileges. This lowers the barrier for malicious actors targeting stored data.

Who is exposed

The flaw affects multiple version lines of the Amazon S3 Encryption Client for .NET. Specifically, versions 2.1.0 and above are impacted. This includes the entire 3.0.0 to 3.2.1 range and the 4.0.0 to 4.0.2 range. Any application using these specific client libraries to encrypt or decrypt S3 objects is potentially vulnerable.

AWS states that the 1.x and 2.x version lines will not receive patches. Users of these older versions must migrate to newer releases. The 3.x and 4.x lines have received fixes. Organisations must identify which version their applications currently use to determine exposure.

Cost and compliance

AWS classifies this security bulletin as important, requiring attention. The disclosure comes from the official AWS Security Bulletins feed. No financial penalties or regulatory fines are mentioned in the advisory. However, the potential for data decryption could trigger compliance reviews for industries with strict data protection rules.

What happens next

AWS has released updates to address the issue. Customers on version 3.x should upgrade to 3.2.2. Those on version 4.x should move to 4.0.3. Teams must also patch any forked or derivative code to incorporate these fixes. Migration is mandatory for users of unsupported 1.x and 2.x versions.

Questions to ask your suppliers

Ask software vendors if their products use the affected .NET client versions. Request confirmation that their code has been updated or migrated. Determine who in your organisation manages these integrations. Teams usually need to coordinate with development leads to verify library versions. Check whether internal tools rely on legacy encryption formats. Ensure that security teams are notified of any third-party dependencies. This helps prevent exposure through supply chain components.

What to do and how to stay safe: AWS

• Audit all .NET applications to identify the version of the Amazon S3 Encryption Client in use.
• Upgrade to version 3.2.2 or 4.0.3 as soon as possible to apply the vendor's fix.
• Migrate any systems running 1.x or 2.x versions to the supported 3.x or 4.x lines.
• Review access controls for S3 buckets to ensure read permissions are strictly limited.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of the S3 Encryption Client are vulnerable?

Versions 2.1.0 and higher, including 3.0.0 to 3.2.1 and 4.0.0 to 4.0.2, are affected by CVE-2026-110310.

Is there a fix available for version 2.x?

No, the 1.x and 2.x lines will not receive patches; users must migrate to version 3.2.2 or 4.0.3.

What is the severity of this vulnerability?

AWS classifies the issue as important, noting it allows decryption of objects via a padding oracle attack.