Go/github.com/aws/amazon-s3-encryption-client-go/v3 CVE-2025-14764: medium 5.3, EPSS 0.11%

Amazon S3 Encryption Client has a Key Commitment Issue

Action: Upgrade github.com/aws/amazon-s3-encryption-client-go/v3 to 4.0.0 or later.

go get github.com/aws/amazon-s3-encryption-client-go/v3@v4.0.0

Affected

Fixed versions

Sources

• osv: GHSA-3g75-q268-r9r6
• https://github.com/aws/amazon-s3-encryption-client-go/security/advisories/GHSA-3g75-q268-r9r6
• https://nvd.nist.gov/vuln/detail/CVE-2025-14764
• https://github.com/aws/amazon-s3-encryption-client-go/commit/3e1740ec014e234e6d454291615011122e642b5d
• https://aws.amazon.com/security/security-bulletins/AWS-2025-032
• https://github.com/aws/amazon-s3-encryption-client-go
• https://github.com/aws/amazon-s3-encryption-client-go/releases/tag/v4.0.0

CVE-2025-14764 · published 2025-12-18T18:50:42Z · modified 2025-12-22T18:41:44.684528Z · JSON