CVE-2026-22611

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22611", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-07T21:50:39.534Z", "datePublished": "2026-01-10T05:37:08.297Z", "dateUpdated": "2026-01-12T14:39:57.770Z"}, "containers": {"cna": {"title": "AWS SDK for .NET V4 adopted defense in depth enhancement for region parameter value", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/aws/aws-sdk-net/security/advisories/GHSA-9cvc-h2w8-phrp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/aws/aws-sdk-net/security/advisories/GHSA-9cvc-h2w8-phrp"}], "affected": [{"vendor": "aws", "product": "aws-sdk-net", "versions": [{"version": ">= 4.0.0, < 4.0.3.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T05:37:08.297Z"}, "descriptions": [{"lang": "en", "value": "AWS SDK for .NET works with Amazon Web Services to help build scalable solutions with Amazon S3, Amazon DynamoDB, Amazon Glacier, and more. From versions 4.0.0 to before 4.0.3.3, Customer applications could be configured to improperly route AWS API calls to non-existent or non-AWS hosts. This notification is related to the use of specific values for the region input field when calling AWS services. An actor with access to the environment in which the SDK is used could set the region input field to an invalid value. This issue has been patched in version 4.0.3.3."}], "source": {"advisory": "GHSA-9cvc-h2w8-phrp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-12T14:39:50.546592Z", "id": "CVE-2026-22611", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T14:39:57.770Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22611", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-12T14:39:50.546592Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T14:39:55.096Z"}}], "cna": {"title": "AWS SDK for .NET V4 adopted defense in depth enhancement for region parameter value", "source": {"advisory": "GHSA-9cvc-h2w8-phrp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "aws", "product": "aws-sdk-net", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.0.3.3"}]}], "references": [{"url": "https://github.com/aws/aws-sdk-net/security/advisories/GHSA-9cvc-h2w8-phrp", "name": "https://github.com/aws/aws-sdk-net/security/advisories/GHSA-9cvc-h2w8-phrp", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "AWS SDK for .NET works with Amazon Web Services to help build scalable solutions with Amazon S3, Amazon DynamoDB, Amazon Glacier, and more. From versions 4.0.0 to before 4.0.3.3, Customer applications could be configured to improperly route AWS API calls to non-existent or non-AWS hosts. This notification is related to the use of specific values for the region input field when calling AWS services. An actor with access to the environment in which the SDK is used could set the region input field to an invalid value. This issue has been patched in version 4.0.3.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T05:37:08.297Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22611", "state": "PUBLISHED", "dateUpdated": "2026-01-12T14:39:57.770Z", "dateReserved": "2026-01-07T21:50:39.534Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-10T05:37:08.297Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "aws-sdk-net", "vendor": "aws", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.0.3.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "AWS SDK for .NET works with Amazon Web Services to help build scalable solutions with Amazon S3, Amazon DynamoDB, Amazon Glacier, and more. From versions 4.0.0 to before 4.0.3.3, Customer applications could be configured to improperly route AWS API calls to non-existent or non-AWS hosts. This notification is related to the use of specific values for the region input field when calling AWS services. An actor with access to the environment in which the SDK is used could set the region input field to an invalid value. This issue has been patched in version 4.0.3.3."}, {"lang": "es", "value": "El SDK de AWS para .NET funciona con Amazon Web Services para ayudar a construir soluciones escalables con Amazon S3, Amazon DynamoDB, Amazon Glacier y m\u00e1s. Desde las versiones 4.0.0 hasta antes de la 4.0.3.3, las aplicaciones del cliente podr\u00edan configurarse para enrutar incorrectamente las llamadas a la API de AWS a hosts inexistentes o que no son de AWS. Esta notificaci\u00f3n est\u00e1 relacionada con el uso de valores espec\u00edficos para el campo de entrada de regi\u00f3n al llamar a los servicios de AWS. Un actor con acceso al entorno en el que se utiliza el SDK podr\u00eda establecer el campo de entrada de regi\u00f3n en un valor no v\u00e1lido. Este problema ha sido parcheado en la versi\u00f3n 4.0.3.3."}], "id": "CVE-2026-22611", "lastModified": "2026-06-17T10:20:09.717", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22611", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-12T14:39:50.546592Z", "version": "2.0.3"}}]}, "published": "2026-01-10T06:15:51.270", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/aws/aws-sdk-net/security/advisories/GHSA-9cvc-h2w8-phrp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:10:35.816983+00:00", "value": {"mitigation_remediation": ["Upgrade the AWS SDK for .NET to version 4.0.3.3 or later.", "Validate all region parameters against a trusted list of AWS region identifiers, rejecting any non\u2011valid values.", "Review application code that constructs or modifies the region field to enforce strict validation and prevent accidental misuse."], "summary": {"action": "Apply Patch", "impact": "Improperly configured region values can redirect AWS SDK for .NET API calls to non\u2011AWS or non\u2011existent hosts, risking data leakage or denial of service"}, "threat_synthesis": {"affected_systems": "The affected products are the AWS SDK for .NET, versions 4.0.0 through 4.0.3.2. The issue was addressed in version 4.0.3.3. Applications that reference the SDK within this vulnerable range and allow region values to be set from untrusted sources are at risk.", "description_and_impact": "The vulnerability permits an actor who controls the execution environment to supply an invalid or non\u2011AWS region value, causing the SDK to route API requests to a non\u2011existent or external host. This may lead to unintended network traffic, potential data leakage, or denial of service to the intended AWS services. The flaw is a classic input validation error (CWE\u201120).", "risk_and_exploitability": "The CVSS score is 3.7, indicating low severity, and the EPSS score is below 1\u202f%, reflecting a very low likelihood of exploitation. Because the flaw requires access to the application\u2019s environment to set the region field, remote exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. The overall risk is modest, but upgrading immediately eliminates the weakness."}}}}, "created": "2026-01-12T14:36:54.404818+00:00", "updated": "2026-04-18T07:15:25.856673+00:00", "vendors": ["amazon", "amazon$PRODUCT$aws_sdk_net"]}