{"action":"Upgrade software.amazon.encryption.s3:amazon-s3-encryption-client-java to 4.0.0 or later.","affected":[{"fixed":"4.0.0","introduced":"0"}],"component":"software.amazon.encryption.s3:amazon-s3-encryption-client-java","cve_ids":["CVE-2025-14763"],"ecosystem":"Maven","epss":0.00118,"exploited":false,"fixed_versions":["4.0.0"],"ghsa_id":"GHSA-x44p-gvrj-pj2r","id":"tcs_01M5N9HPD32Z1M57F1FBEK52NX","modified_at":"2026-09-10T03:50:32.333897132Z","published_at":"2025-12-18T15:47:07Z","references":["https://osv.dev/vulnerability/GHSA-x44p-gvrj-pj2r","https://github.com/aws/amazon-s3-encryption-client-java/security/advisories/GHSA-x44p-gvrj-pj2r","https://nvd.nist.gov/vuln/detail/CVE-2025-14763","https://github.com/aws/amazon-s3-encryption-client-java/commit/9d4523edbbc249781b3b3b3f8868fad39c5673d5","https://aws.amazon.com/security/security-bulletins/AWS-2025-032","https://github.com/aws/amazon-s3-encryption-client-java","https://github.com/aws/amazon-s3-encryption-client-java/releases/tag/v4.0.0"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-x44p-gvrj-pj2r","url":"https://osv.dev/vulnerability/GHSA-x44p-gvrj-pj2r"}],"summary":"Amazon S3 Encryption Client for Java has a Key Commitment Issue"}