CVE-2025-14763

Maven/software.amazon.encryption.s3:amazon-s3-encryption-client-java CVE-2025-14763: medium 5.3, EPSS 0.12%

Amazon S3 Encryption Client for Java has a Key Commitment Issue

Action: Upgrade software.amazon.encryption.s3:amazon-s3-encryption-client-java to 4.0.0 or later.

Affected

Fixed versions

Sources

• osv: GHSA-x44p-gvrj-pj2r
• https://github.com/aws/amazon-s3-encryption-client-java/security/advisories/GHSA-x44p-gvrj-pj2r
• https://nvd.nist.gov/vuln/detail/CVE-2025-14763
• https://github.com/aws/amazon-s3-encryption-client-java/commit/9d4523edbbc249781b3b3b3f8868fad39c5673d5
• https://aws.amazon.com/security/security-bulletins/AWS-2025-032
• https://github.com/aws/amazon-s3-encryption-client-java
• https://github.com/aws/amazon-s3-encryption-client-java/releases/tag/v4.0.0

CVE-2025-14763 · published 2025-12-18T15:47:07Z · modified 2026-09-10T03:50:32.333897132Z · JSON