Skip to main content

AWS CVE-2026-16317

| EUVDEUVD-2026-46399 HIGH
Improper Validation of Integrity Check Value (CWE-354)
2026-07-21 AMZN
Information Disclosure AWS Suse S2N Tls
8.3
CVSS 4.0 · Vendor: AMZN
Share

Severity by source

Vendor (AMZN) PRIMARY
8.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Active network MitM required (AV:N, AC:H); no authentication or interaction needed; integrity is high due to silent undetectable suppression; no confidentiality or scope impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

7
Analysis Updated
Jul 21, 2026 - 21:31 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 21, 2026 - 21:22 vuln.today
cvss_changed
Severity Changed
Jul 21, 2026 - 21:22 NVD
MEDIUM HIGH
CVSS changed
Jul 21, 2026 - 21:22 NVD
6.5 (MEDIUM) 8.3 (HIGH)
Source Code Evidence Fetched
Jul 21, 2026 - 21:07 vuln.today
Analysis Generated
Jul 21, 2026 - 21:07 vuln.today
CVE Published
Jul 21, 2026 - 20:12 cve.org
MEDIUM 6.5

DescriptionCVE.org

Missing validation of the outer content_type byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer content_type of all encrypted TLS 1.3 records must be application_data (0x17). The s2n-tls AEAD implementation hardcodes this value in the additional authenticated data rather than using the actual wire byte, so the outer content_type is not covered by the authentication tag.

This enables selective suppression of application data. In HTTP pipelining scenarios, dropping a TLS record containing an HTTP request can cause request/response desynchronization, where subsequent responses are delivered to the wrong requests. In write-heavy workloads, a dropped record containing a write request can result in undetectable data loss when the client interprets a subsequent success response as confirmation of the dropped write.

All TLS 1.3 connections are affected. Both TLS clients and servers are affected. TLS 1.2 and QUIC connections are not affected.

We recommend you upgrade s2n-tls to version v1.7.6

AnalysisAI

Silent record suppression in AWS s2n-tls affects all TLS 1.3 connections (both client and server roles) because the AEAD implementation hardcodes the outer content_type (0x17) in the additional authenticated data instead of authenticating the actual wire byte, leaving that field outside the integrity tag. An active on-path attacker can selectively drop individual application_data records without either endpoint detecting tampering, causing HTTP request/response desynchronization or undetectable data loss on write-heavy workloads. Reported internally by Amazon (AMZN); no public exploit identified at time of analysis, and it is not listed in CISA KEV.

More in AWS

View all
CVE-2026-27702 CRITICAL POC
9.9 Feb 25

Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
CVE-2020-37153 CRITICAL POC
9.8 Feb 11

Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
CVE-2026-87911 CRITICAL POC
9.0 Sep 09

Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on
CVE-2026-11393 HIGH POC
8.8 Jun 08

Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
CVE-2026-16756 HIGH POC
8.7 Jul 23

Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
CVE-2026-16796 HIGH POC
8.4 Jul 23

Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary

CVE-2026-9133 HIGH POC
8.3 May 20

Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
CVE-2026-13763 HIGH POC
7.9 Jun 29

WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
CVE-2026-13762 HIGH POC
7.9 Jun 29

WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
CVE-2026-4295 HIGH POC
7.8 Mar 17

A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
CVE-2019-25333 HIGH POC
7.5 Feb 12

Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to

CVE-2026-7461 HIGH POC
7.5 Apr 30

Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to exec

Same weakness CWE-354 – Improper Validation of Integrity Check Value

View all
CVE-2023-48795 MEDIUM POC
5.9
CVE-2024-3596 CRITICAL
9.0
CVE-2023-33668 CRITICAL POC
9.8
CVE-2026-50021 HIGH POC
8.1
CVE-2022-36174 HIGH POC
8.1
CVE-2019-13496 HIGH POC
8.1
CVE-2024-51141 HIGH POC
7.8
CVE-2023-38802 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Public Cloud 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-16317 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy