---
id: CVE-2022-2582
aliases:
  - GHSA-6jvc-q2x7-pchv
  - GHSA-76wf-9vgp-pj7w
  - GO-2022-0391
title: >-
  AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the
  ciphertext as a metadata field
summary: >-
  AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the
  ciphertext as a metadata field
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
vendor: aws
product: github.com/aws/aws-sdk-go
ecosystem: go
affected:
  - github.com/aws/aws-sdk-go < 1.34.0
patched:
  - github.com/aws/aws-sdk-go 1.34.0
published: '2022-12-28'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:56.186653741Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6jvc-q2x7-pchv'
references:
  - url: >-
      https://github.com/google/security-research/security/advisories/GHSA-76wf-9vgp-pj7w
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-2582'
  - url: >-
      https://github.com/aws/aws-sdk-go/commit/35fa6ddf45c061e0f08d3a3b5119f8f4da38f6d1
  - url: 'https://github.com/aws/aws-sdk-go'
  - url: 'https://pkg.go.dev/vuln/GO-2022-0391'
tags:
  - osv
  - go
epss: 0.00481
epssPercentile: 0.40675
ingestedAt: '2026-09-12T03:13:01.759Z'
---

## Overview

The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it.

## Affected packages

- `github.com/aws/aws-sdk-go < 1.34.0`

## Remediation

Upgrade to a patched release:

- `github.com/aws/aws-sdk-go 1.34.0`