VDB
GHSA-443w-3rq3-5m5h
GHSA-443w-3rq3-5m5h
PUBLISHED
CVSS 9.300000190734863 CRITICAL
AWS SDK for Java 2.0: Improper Handling of Special Characters in CloudFront Signing Utilities
Risk Scores
CVSS 3.1
9.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Maven | software.amazon.awssdk:cloudfront | 2.25.0, 2.20.137, 2.28.25 |
| chainguard | hadoop-fips-3.5 | 0 |
| wolfi | druid | 0, 0, 0 |
| chainguard | druid | 0, 0, 0 |
Timeline
- Mar 27, 2026 CVE Published
References
- https://github.com/aws/aws-sdk-java-v2 package
- AWS SDK for Java 2.0: Improper Handling of Special Characters in CloudFront Signing Utilities advisory
- https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/security.html url
- https://github.com/aws/aws-sdk-java-v2/blob/master/services/cloudfront/src/main/java/software/amazon/awssdk/services/cloudfront/CloudFrontUtilities.java url
- https://github.com/aws/aws-sdk-java-v2/security/advisories/GHSA-443w-3rq3-5m5h url