CVE-2026-6550

Published: Apr 20, 2026Modified: Jun 17, 2026

5.7

Vector

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5 (Secondary)

Description

Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts. To remediate this issue, users should upgrade to version 3.3.1, 4.0.5 or above.

Related CWEs

CWE-757

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

References (4)

https://aws.amazon.com/security/security-bulletins/2026-017-aws/

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

https://github.com/aws/aws-encryption-sdk-python/releases/tag/v3.3.1

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

https://github.com/aws/aws-encryption-sdk-python/releases/tag/v4.0.5

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

https://github.com/aws/aws-encryption-sdk-python/security/advisories/GHSA-v638-38fc-rhfv

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Timeline

No history available yet.