CVE-2025-14763
Medium · 5.3CVSS
5.3
EPSS
0.1%
Published
Dec 17, 2025
CISA due date
—
The record
Missing cryptographic key commitment in the Amazon S3 Encryption Client for Java may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgrade Amazon S3 Encryption Client for Java to version 4.0.0 or later.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | software.amazon.encryption.s3:amazon-s3-encryption-client-java | 0 | 4.0.0 |
| Chainguard | apache-nifi | 0 | 2.7.2-r2 |
| Chainguard | apache-nifi-compat | 0 | 2.7.2-r2 |
| Chainguard | apache-nifi-toolkit | 0 | 2.7.2-r2 |
| Wolfi | apache-nifi | 0 | 2.7.2-r2 |
| Wolfi | apache-nifi-compat | 0 | 2.7.2-r2 |
| Wolfi | apache-nifi-toolkit | 0 | 2.7.2-r2 |
Related vulnerabilities
- CVE-2026-22732 When applications specify HTTP response headers for servlet applications using Spring… Also affects apache-nifi
- CVE-2026-24281 Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR)… Also affects apache-nifi
- CVE-2026-24308 Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4… Also affects apache-nifi
- CVE-2026-29062 jackson-core contains core low-level incremental ("streaming") parser and generator… Also affects apache-nifi
- CVE-2026-1225 ACE vulnerability in configuration file processing by QOS.CH logback-core up to and… Also affects apache-nifi
- CVE-2024-29371 In jose4j before 0.9.5, an attacker can cause a Denial-of-Service (DoS) condition by… Also affects apache-nifi
- CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Also affects apache-nifi
- CVE-2025-11226 ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up… Also affects apache-nifi