Go/github.com/aws/amazon-s3-encryption-client-go/v4 CVE-2025-14764: medium 5.3, EPSS 0.11%

Amazon S3 Encryption Client has a Key Commitment Issue in github.com/aws/amazon-s3-encryption-client-go

Action: Upgrade github.com/aws/amazon-s3-encryption-client-go/v4 to 4.0.0 or later.

go get github.com/aws/amazon-s3-encryption-client-go/v4@v4.0.0

Affected

Fixed versions

Sources

• osv: GO-2025-4250#Go/github.com/aws/amazon-s3-encryption-client-go/v4
• nvd: CVE-2025-14764
• https://github.com/aws/amazon-s3-encryption-client-go/security/advisories/GHSA-3g75-q268-r9r6
• https://github.com/aws/amazon-s3-encryption-client-go/commit/3e1740ec014e234e6d454291615011122e642b5d
• https://aws.amazon.com/security/security-bulletins/AWS-2025-032
• https://github.com/aws/amazon-s3-encryption-client-go/releases/tag/v4.0.0

CVE-2025-14764 · published 2025-12-22T18:15:35Z · modified 2026-03-03T04:57:50.936791Z · JSON