CVE-2026-6550
Medium · 4.7CVSS
4.7
EPSS
0.1%
Published
Apr 20, 2026
CISA due date
—
The record
Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts. To remediate this issue, users should upgrade to version 3.3.1, 4.0.5 or above.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-89177 WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of… CWE-757
- CVE-2026-59293 Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate… CWE-757
- CVE-2026-72889 Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature… CWE-757
- CVE-2026-72887 Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently… CWE-757
- CVE-2026-55953 The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher… CWE-757
- CVE-2026-54780 CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET… CWE-757
- CVE-2026-54291 pgjdbc is an open source postgresql JDBC Driver. CWE-757
- CVE-2026-6092 When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to… CWE-757