GHSA-464c-974j-9xm6: AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

July 24, 2026

The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. We identified an issue in which explicitly setting encrypted: true on the S3LoggingOptions property of an AWS CodeBuild project construct produces the opposite of the intended behavior, disabling encryption on CodeBuild build logs stored in S3.

References

github.com/advisories/GHSA-464c-974j-9xm6
github.com/aws/aws-cdk/commit/40319185dc645d2afc6acf1d25547a86250e97af
github.com/aws/aws-cdk/pull/37761
github.com/aws/aws-cdk/releases/tag/v2.253.0
github.com/aws/aws-cdk/security/advisories/GHSA-464c-974j-9xm6

Code Behaviors & Features

Detect and mitigate GHSA-464c-974j-9xm6 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →