CVE-2026-110310

MediumCVSS 5.3/10Last modified Oct 16, 2026

Description

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object.

To remediate this issue, we recommend that users upgrade to version 3.2.2 or 4.0.3. The 1.x and 2.x lines will not be patched, users of those lines need to migrate to 3.2.2 or 4.0.3.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-204 CWE-757

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 14, 2026
Last modified: Oct 16, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1103114.3Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachme CVE-2026-110326.5Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data CVE-2026-1103225.5The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields duri CVE-2026-1103246.5The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a CVE-2026-110336.5Uninitialized Use in WebML in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive informat CVE-2026-110346.1Insufficient validation of untrusted input in Tab Group Sync in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to CVE-2026-110357.3Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to perform privilege CVE-2026-1103537.5HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncate CVE-2026-1103547.5HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via a CVE-2026-1103597.8Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running fr CVE-2026-110366.5Inappropriate implementation in DOM in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a cra CVE-2026-1103605.3Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting Incorrectly Configured Access Control Se