🎯 New Report #3620748: V1Plugin.Decrypt panics on empty ciphertext (Remote DoS)
🔺Severity: Medium
👽 Reporter: misop00p
⭐️ Reputation: 182
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-03-22
⏰ Disclosed: 2026-05-28 16:40:31
📝 Summary: A vulnerability was discovered in the aws-encryption-provider component of the pkg/plugin/plugin.go file at revision 4341c70. The vulnerability caused the V1Plugin.Decrypt function to panic when passed an empty ciphertext, crashing the entire gRPC server process. This was due to the function accessing the Cipher field without checking if the slice was non-empty.
📂 Report JSON File: 3620748
@hackeronereports