Threats affecting pkg:pypi/aws-encryption-sdk

CVE-2026-6550 is a cryptographic algorithm downgrade vulnerability in the caching layer of the AWS Encryption SDK for Python. It affects versions before 3.3.1 and before 4.0.5. An authenticated local attacker could exploit this to bypass key commitment policy enforcement via a shared key cache, causing ciphertext to decrypt to multiple different plaintexts. AWS has released fixed versions 3.3.1 and 4.0.5 to address this issue.