VulnSocial

CVE-2026-110310

LOWCVSS 6.0 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object. To remediate this issue, we recommend that users upgrade to version 3.2.2 or 4.0.3. The 1.x and 2.x lines will not be patched, users of those lines need to migrate to 3.2.2 or 4.0.3.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-204CWE-757

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-17: 110-17
Referenced assets1 URL
Full discourse1 post
  • SHELLCODE@sh3ll_c0d3

    ☁️ AWS S3 CRYPTO ORACLE (CVE-2026-110310)! Padding oracle flaw in S3 .NET Encryption Client allows attackers to recover encrypted data without keys. Read full Blog: https://sh3llc0d3.com/blog/amazon-s3-encryption-client-for-net-padding-oracle-analyzing-cve-2026-110310-and-aws-bulletin-2026-138-aws/ #Hacktober #CyberAwareness #sh3llc0d3 #shellcode #AWS #CloudSecurity #Crypto

    0000036
    128 followersView on X

Explore more

Back to dashboard