{"cve":"CVE-2025-14764","nvd":{"published":"2025-12-17T21:15:53.847","modified":"2026-09-30T23:10:00.237","status":"Deferred","description":"Missing cryptographic key commitment in the Amazon S3 Encryption Client for Go may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an \"instruction file\" instead of S3's metadata record.\n\n\nTo mitigate this issue, upgrade Amazon S3 Encryption Client for Go to version 4.0 or later.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":6.0},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","score":5.3},"cwes":["CWE-327"],"references":["https://aws.amazon.com/security/security-bulletins/AWS-2025-032/","https://github.com/aws/amazon-s3-encryption-client-go/releases/tag/v4.0.0","https://github.com/aws/amazon-s3-encryption-client-go/security/advisories/GHSA-3g75-q268-r9r6"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:17:07.138532058+00:00"},"epss":{"cve":"CVE-2025-14764","score":0.00108,"percentile":0.0117,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-3g75-q268-r9r6","url":"https://osv.dev/vulnerability/GHSA-3g75-q268-r9r6","summary":"Amazon S3 Encryption Client has a Key Commitment Issue","modified":"2025-12-22T18:41:44.684528Z","packages":[{"ecosystem":"Go","name":"github.com/aws/amazon-s3-encryption-client-go/v3","purl":"pkg:golang/github.com/aws/amazon-s3-encryption-client-go/v3","ranges":["<4.0.0"],"fixed":["4.0.0"]}]},{"id":"GO-2025-4250","url":"https://osv.dev/vulnerability/GO-2025-4250","summary":"Amazon S3 Encryption Client has a Key Commitment Issue in github.com/aws/amazon-s3-encryption-client-go","modified":"2026-03-03T04:57:50.936791Z","packages":[{"ecosystem":"Go","name":"github.com/aws/amazon-s3-encryption-client-go","purl":"pkg:golang/github.com/aws/amazon-s3-encryption-client-go","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/aws/amazon-s3-encryption-client-go/v3","purl":"pkg:golang/github.com/aws/amazon-s3-encryption-client-go/v3","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/aws/amazon-s3-encryption-client-go/v4","purl":"pkg:golang/github.com/aws/amazon-s3-encryption-client-go/v4","ranges":["<4.0.0"],"fixed":["4.0.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}