—
GO-2025-4250
Amazon S3 Encryption Client has a Key Commitment Issue in github.com/aws/amazon-s3-encryption-client-go
Quick fix
GO-2025-4250 — github.com/aws/amazon-s3-encryption-client-go/v4: upgrade to the fixed version with the command below.
go get github.com/aws/amazon-s3-encryption-client-go/v4@v4.0.0Details
Amazon S3 Encryption Client has a Key Commitment Issue in github.com/aws/amazon-s3-encryption-client-go
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/aws/amazon-s3-encryption-client-go
Introduced in:
0No fixed version published yet for github.com/aws/amazon-s3-encryption-client-go (go modules). Pin to a known-safe version or switch to an alternative.
Go/github.com/aws/amazon-s3-encryption-client-go/v3
Introduced in:
0No fixed version published yet for github.com/aws/amazon-s3-encryption-client-go/v3 (go modules). Pin to a known-safe version or switch to an alternative.
Go/github.com/aws/amazon-s3-encryption-client-go/v4
Introduced in:
0Fixed in: 4.0.0Fix
go get github.com/aws/amazon-s3-encryption-client-go/v4@v4.0.0References
- https://github.com/aws/amazon-s3-encryption-client-go/security/advisories/GHSA-3g75-q268-r9r6[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2025-14764[ADVISORY]
- https://github.com/aws/amazon-s3-encryption-client-go/commit/3e1740ec014e234e6d454291615011122e642b5d[FIX]
- https://aws.amazon.com/security/security-bulletins/AWS-2025-032[WEB]
- https://github.com/aws/amazon-s3-encryption-client-go/releases/tag/v4.0.0[WEB]