Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

software.amazon.awssdk:cloudfront

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.7MavenPublished

    AWS SDK for Java 2.0: Improper Handling of Special Characters in CloudFront Signing Utilities

    GHSA-443w-3rq3-5m5h

    Affected
    • Maven software.amazon.awssdk:cloudfront >= 2.18.33, <= 2.41.29
    Fixed in
    2.41.30· Vendor fix available
    Issue
    This notification is related to the CloudFront signing utilities in the AWS SDK for Java v2, which are used to generate Amazon CloudFront signed URLs and signed cookies. A defense-in-depth enhancement has been implemented to improve handling of special characters, such as double quotes and backslashes, in input values. Impact The CloudFront signing utilities build policy documents that define access restrictions for signed URLs and cookies. If an application passes unsanitized input containing special characters to these utilities, the resulting policy document may not reflect the application's intended access restrictions. While the SDK was functioning safely within the requirements of the shared responsibility model, additional safeguards have been added to support secure customer implementations. Applications that already follow AWS security best practices for input validation are not impacted. Impacted versions: 2.18.33 - 2.41.29 Patches On 2026.02.16, an enhancement was…

    Recommended action: Upgrade to 2.41.30 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →