Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-14761

Good to know:

icon
icon

Date: December 17, 2025

Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgrade AWS SDK for PHP to version 3.368.0 or later

Severity Score

Related Resources (9)

https://aws.amazon.com/security/security-bulletins/AWS-2025-032/
https://github.com/FriendsOfPHP/security-advisories/blob/master/aws/aws-sdk-php/CVE-2025-14761.yaml
https://nvd.nist.gov/vuln/detail/CVE-2025-14761
https://github.com/aws/aws-sdk-php/security/advisories/GHSA-x8cp-jf6f-r4xh
https://github.com/aws/aws-sdk-php/commit/6827cac70397dca07e6e86f7cf630954ec2bc6bf
https://github.com/aws/aws-sdk-php/releases/tag/3.368.0
https://github.com/aws/aws-sdk-php
https://aws.amazon.com/security/security-bulletins/AWS-2025-032
https://www.mend.io/vulnerability-database/CVE-2025-14761

Severity Score

Weakness Type (CWE)

Use of a Broken or Risky Cryptographic Algorithm

CWE-327

Top Fix

icon

Upgrade Version

Upgrade to version aws/aws-sdk-php - 3.368.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us