The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.
References
| Link | Resource |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117 | Vendor Advisory |
Configurations
History
22 May 2026, 23:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6. |
15 May 2026, 18:38
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Microsoft
Microsoft azure Sdk For Java |
|
| CPE | cpe:2.3:a:microsoft:azure_sdk_for_java:*:*:*:*:*:*:*:* | |
| References | () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117 - Vendor Advisory |
12 May 2026, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-12 18:17
Updated : 2026-05-22 23:16
NVD link : CVE-2026-33117
Mitre link : CVE-2026-33117
CVE.ORG link : CVE-2026-33117
JSON object : View
Products Affected
microsoft
- azure_sdk_for_java