CVE-2026-110310 in Extensions.S3.Encryption
Summary
by MITRE • 10/14/2026
A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object.
To remediate this issue, we recommend that users upgrade to version 3.2.2 or 4.0.3. The 1.x and 2.x lines will not be patched, users of those lines need to migrate to 3.2.2 or 4.0.3.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described constitutes a critical cryptographic implementation flaw within an S3-compatible storage system that utilizes RSA encryption for object protection. The core issue stems from the ability of any user with read access to modify metadata associated with encrypted objects, specifically by altering the recorded padding scheme identifier from a secure standard like OAEP to legacy PKCS#1 v1.5. This manipulation allows attackers to exploit known weaknesses in older cryptographic standards that have been deprecated due their susceptibility to adaptive chosen-ciphertext attacks. By forcing the decryption process to use this vulnerable padding method, an attacker can leverage a padding oracle attack mechanism to iteratively probe the system and recover the RSA-wrapped envelope key without possessing the private key initially required for decryption.
The technical flaw relies on the fundamental difference in error handling between secure and legacy cryptographic schemes. PKCS#1 v1.5 encryption is notoriously vulnerable to Bleichenbacher attacks, where an attacker sends specially crafted ciphertexts to a server and observes subtle differences in error messages or timing responses to deduce information about the plaintext. In this scenario, by changing the metadata to indicate that the object was encrypted using PKCS#1 v1.5, the system attempts to decrypt it using that legacy algorithm. If the decryption fails due to invalid padding, the system may return a specific error code or exhibit measurable latency differences compared to successful decryptions. An attacker can exploit these side-channel indicators to perform a byte-by-byte recovery of the envelope key, effectively bypassing the encryption security entirely and gaining unauthorized access to sensitive data stored in the bucket.
From an operational impact perspective, this vulnerability undermines the confidentiality guarantees provided by server-side encryption for S3 buckets. Any user with read permissions on specific objects can potentially decrypt them if they are willing to perform the necessary cryptographic oracle attacks. This is particularly dangerous because it allows privilege escalation from simple read access to full data exfiltration capabilities without requiring administrative privileges or key management system compromise. The attack vector is remote and does not require physical access, making it a significant threat in multi-tenant environments where users may have legitimate but limited access rights that they could abuse for unauthorized data retrieval.
This vulnerability aligns with CWE-327, which covers the use of broken or risky cryptographic algorithms, specifically referencing the deprecation of PKCS#1 v1.5 encryption padding due to its known vulnerabilities against adaptive chosen-ciphertext attacks. Furthermore, it relates to CWE-694, which addresses the use of a component in an incorrect context, as the system incorrectly processes metadata that dictates decryption parameters without validating whether such modifications are authorized or safe for cryptographic operations. In terms of MITRE ATT&CK framework tactics, this exploitation falls under Initial Access and Credential Access categories, specifically leveraging techniques similar to T1552.004 (Unsecured Credentials) through oracle-based key recovery methods.
To remediate this issue, organizations must upgrade their S3-compatible storage software or client libraries to version 3.2.2 or 4.0.3, as these versions include fixes that prevent the exploitation of padding oracle attacks by either rejecting metadata modifications for encrypted objects or enforcing stricter validation of cryptographic parameters. Users operating on legacy 1.x and 2.x release lines are advised that no patches will be provided for those branches due to architectural limitations; therefore, a migration strategy to newer supported versions is mandatory to restore security posture. Additionally, implementing strict access controls over metadata modification permissions can provide defense-in-depth by limiting the ability of users to alter encryption-related attributes even before software updates are applied.