Bulletin ID: 2026-135-AWSScope: AWSContent Type: Important (requires attention)Publication Date: 10/14/2026 12:30 PM PDTDescription:We identified CVE-2026-110310, an issue in Amazon S3 encryption client for .NET that could allow a remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object.Impacted versions: >= 2.1.0; 3.0.0 to 3.2.1; 4.0.0 to 4.0.2Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.