p PatchFirst

CVE-2026-6550

CVE-2026-6550 · Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts. To remediate this issue, users should upgrade to version 3.3.1, 4.0.5 or above.

CVSS 5.7 · Medium · EPSS 0.1% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • aws encryption sdk for python

    Versions
    • ≥ 2, ≤ 2.5.1: Affected (custom)
    • ≥ 3, ≤ 3.3.0: Affected (custom)
    • ≥ 4, ≤ 4.0.4: Affected (custom)

    No fix published

  • aws-encryption-sdk PyPI

    Versions
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.3.0
    • 2.4.0
    • 2.5.0
    • 2.5.1
    • 3.0.0
    • 3.1.0
    • 3.1.1
    • 3.2.0
    • 3.3.0
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 3.3.1

    Update to 3.3.1

  • aws-encryption-sdk PyPI

    Versions
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.0.3
    • 4.0.4
    Affected ranges
    • ECOSYSTEM: ≥ 4.0.0, < 4.0.5

    Update to 4.0.5

  • aws-encryption-sdk PyPI

    Versions
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.3.0
    • 2.4.0
    • 2.5.0
    • 2.5.1
    • 3.0.0
    • 3.1.0
    • 3.1.1
    • 3.2.0
    • 3.3.0
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.0.3
    • 4.0.4
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 3.3.1 ∪ ≥ 4.0.0, < 4.0.5

    Update to 3.3.1; Update to 4.0.5

Original sources

Check your server →