aws-kms-tls-auth vulnerable to memory overallocationGHSA-5whh-4q9j-7v28
LOWGHSA-5whh-4q9j-7v28 is a low-severity (CVSS 3.7) vulnerability in aws-kms-tls-auth. A fix is available for aws-kms-tls-auth — see the affected versions and patch details below.
Real-World Exposure
aws-kms-tls-authReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
Summary
aws-kms-tls-auth is an optional utility for s2n-tls that enables customers to use AWS KMS keys as part of the PSK extension field in a TLS 1.3 handshake. An issue exists in this library that can lead to overallocation of memory potentially resulting in a denial of service.
Impact
The PSK extension field in TLS 1.3 uses length-prefixed lists to encode variable-length data. aws-kms-tls-auth interprets the length prefix incorrectly resulting in additional memory allocation.
s2n-tls limits ClientHello messages to 64 KB. Due to this issue, the server may allocate up to 10× the received size, meaning a single message could trigger an allocation of up to 640 KB. Repeated allocations of this size could exhaust server resources and lead to a denial-of-service.
No AWS services are affected. Applications should continue to follow best practices by limiting the number of in-flight handshakes and concurrent connections. Applications using the aws-kms-tls-auth crate should upgrade to version 0.0.3.
Impacted versions: < 0.0.3
Patches
This issue has been addressed in aws-kms-tls-auth v0.0.3 [1].
Workarounds
There is no workaround. Applications using aws-kms-tls-auth should upgrade to the most recent release.
Acknowledgement
s2n-tls would like to thank Joshua Rogers (https://joshua.hu/) of AISLE Research Team (https://aisle.com/) for collaborating on this issue through the coordinated disclosure process.
If there are any questions or comments about this advisory, contact AWS/Amazon Security via the vulnerability reporting page [2] or directly via email to [email protected]. Please do not create a public GitHub issue.
[1] https://crates.io/crates/aws-kms-tls-auth/0.0.3 [2] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | aws-kms-tls-auth | all versions | 0.0.3cargo update -p aws-kms-tls-auth --precise 0.0.3 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for aws-kms-tls-auth, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update aws-kms-tls-auth to 0.0.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5whh-4q9j-7v28 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Frequently Asked Questions
Is GHSA-5whh-4q9j-7v28 in your dependencies?
Find it across crates.io, including transitive dependencies.