CVE-2026-22611

Description

AWS SDK for .NET works with Amazon Web Services to help build scalable solutions with Amazon S3, Amazon DynamoDB, Amazon Glacier, and more. From versions 4.0.0 to before 4.0.3.3, Customer applications could be configured to improperly route AWS API calls to non-existent or non-AWS hosts. This notification is related to the use of specific values for the region input field when calling AWS services. An actor with access to the environment in which the SDK is used could set the region input field to an invalid value. This issue has been patched in version 4.0.3.3.

Risk Information

Base Score

3.7

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score

Exploitation Probability

0.061

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2026-22611 are fixed in Nuget - AWSSDK.Core 4.0.3.3	Windows
Vulnerabilities CVE-2026-22611 are fixed in Nuget - AWSSDK.Core for Linux 4.0.3.3	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234