CVE-2026-22611: 
AWS SDK for .NET vulnerability analysis and mitigation

CVE-2026-22611 is a defense-in-depth deficiency in the AWS SDK for .NET V4 (NuGet package AWSSDK.Core) that allows an actor with environment access to set the region input field to an invalid value, potentially routing AWS API calls to non-existent or non-AWS hosts. It affects all versions of AWSSDK.Core >= 4.0.0 and < 4.0.3.3 (NuGet versioning); the advisory notes the impacted range as all AWS SDK for .NET V4 releases prior to 4.0.139.0. The AWS SDK for .NET V3 is not affected. The vulnerability was disclosed on January 8, 2026, with the fix having been released on November 21, 2025. It carries a CVSS v3.1 base score of 3.7 (Low) (Github Advisory, AWS Advisory).

The root cause is improper input validation (CWE-20) of the region parameter used to construct AWS service endpoint URLs. Prior to the fix, the SDK did not validate that the region value was a properly formatted host label, meaning a malicious or misconfigured value could cause the SDK to construct and send requests to arbitrary, non-AWS hostnames. An actor with access to the application's environment — such as the ability to set environment variables or configuration files — could supply a crafted region string to redirect API traffic. The fix, introduced in PR #4150, adds validation ensuring the region conforms to valid host label formatting before endpoint URL construction (Github Advisory, AWS Advisory).

The primary risk is limited information disclosure: AWS API calls (potentially including authentication credentials or request payloads) could be routed to attacker-controlled or non-existent hosts if the region parameter is tampered with. The CVSS assessment reflects low confidentiality impact with no integrity or availability impact. Exploitation requires an actor to already have access to the application's runtime environment, limiting the practical blast radius, though credential interception via a rogue endpoint remains a concern (Github Advisory).

There is no evidence of in-the-wild exploitation, no public proof-of-concept exploit code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038% (12th percentile), indicating a very low probability of exploitation in the near term. Exploitation requires local or privileged access to the application environment to manipulate the region configuration, significantly raising the bar for remote attackers (Github Advisory).

Update the AWSSDK.Core NuGet package to version 4.0.3.3 or later (corresponding to the 4.0.139.0 SDK release), which was made available on November 21, 2025. No configuration-based workarounds are required, but developers should implement proper input validation for region values in application code and follow AWS SDK security best practices. Regularly updating to the latest AWS SDK for .NET release is also recommended (Github Advisory, AWS Advisory).

The advisory was published by AWS as an informational notice, explicitly framing it as a defense-in-depth enhancement rather than a critical security flaw, and acknowledging that the SDK was operating within the shared responsibility model prior to the fix. Researcher Guy Arazi was credited for responsible disclosure through coordinated disclosure. Community reaction has been minimal given the low severity rating and the fact that the patch predated the advisory by nearly two months (AWS Advisory).