Improper Verification of Cryptographic Signature in aws-encryption-sdk-java
Summary
GHSA-55xh-53m6-936r: Improper Verification of Cryptographic Signature in aws-encryption-sdk-java. Affects com.amazonaws:aws-encryption-sdk-java across 2 version ranges.
< 1.9.0
>= 2.0.0, < 2.2.0
Fixed in 1.9.0 or 2.2.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aws-encryption-sdk-java package is an open-source library that provides encryption and decryption functionality for AWS services. It supports a streaming mode where callers can stream plaintext of signed messages before the ECDSA signature is validated. The package uses AES-GCM encryption and verifies the plaintext before releasing it to the caller. However, there is a vulnerability in the package that allows certain invalid ECDSA signatures to pass validation, potentially impacting the non-repudiation of messages.
Vulnerability Detail
The vulnerability in aws-encryption-sdk-java allows certain invalid ECDSA signatures to incorrectly pass validation. While this does not impact the integrity of decrypted plaintext, it may affect the non-repudiation provided by the ECDSA signature. An actor with trusted KMS permissions to decrypt a message may also be able to encrypt messages without validating the ECDSA signature. The vulnerability also introduces a risk for processing messages from untrusted sources, as it does not limit the number of Encrypted Data Keys (EDKs) that the package will attempt to process per message. This can result in excessive AWS KMS Decrypt API calls. Additionally, the package may not reject messages with certain invalid combinations of algorithm suite and header data.
How To Fix
Latest published version: 3.0.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.9.01.9.0 -
>= 2.0.0, < 2.2.02.2.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability.
Conclusion
The vulnerability in aws-encryption-sdk-java allows certain invalid ECDSA signatures to pass validation, potentially impacting the non-repudiation of messages. It also introduces risks for processing messages from untrusted sources. Users should upgrade to the fixed versions of the package and follow the recommended steps to mitigate the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for com.amazonaws:aws-encryption-sdk-java →
FAQ
The impact of this vulnerability is primarily on the non-repudiation provided by the ECDSA signature. It may also allow an actor with trusted KMS permissions to encrypt messages without validating the signature.
There are no known exploits for this vulnerability at the moment.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
No, the recommended mitigation is to upgrade to the fixed versions of the aws-encryption-sdk-java package.
No, the integrity of ciphertext and decrypted plaintext is not impacted by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.amazonaws:aws-encryption-sdk-java.
