aws/s2n-tls

Scanned on Jun 4, 2026

Risk score/ 100

High risk

Summary

The aws/s2n-tls repository contains 62 critical and 156 high-severity quantum-vulnerable cryptographic implementations across 44 files. MD5, SHA-1, and SSLv2/SSLv3 protocols pose immediate security risks, while extensive use of ECDSA, RSA-PKCS#1, and elliptic curve cryptography (P-256, P-384, P-521, X25519) creates significant post-quantum vulnerability. Migration to NIST-approved PQC algorithms is essential for long-term cryptographic resilience.

Critical

High

138

Medium

Low

Top findings

CriticalSSLv2 / SSLv3

crypto/s2n_hmac.c:136

Raw evidence

case S2N_HMAC_SSLv3_SHA1: *xor_pad_size = 40;   break;

CriticalMD5

api/unstable/fingerprint.h:169

SHA3-256 or SHA-256

Raw evidence

* Currently the only type supported is S2N_FINGERPRINT_JA3, which uses MD5 and

CriticalSSLv2 / SSLv3

crypto/s2n_hmac.c:135

Raw evidence

case S2N_HMAC_SSLv3_MD5:  *xor_pad_size = 48;   break;

CriticalSSLv2 / SSLv3

crypto/s2n_hmac.c:78

Raw evidence

static int s2n_sslv3_mac_init(struct s2n_hmac_state *state, s2n_hmac_algorithm alg, const void *key, uint32_t klen)

CriticalSSLv2 / SSLv3
bindings/rust/extended/s2n-tls/src/enums.rs:95
Raw evidence
```
s2n_tls_version::SSLV3 => Self::SSLV3,
```

+ 195 more findings in the full report

Scan your own repository

Free. Results in ~90 seconds. CBOM + DORA/NIS2 PDF included.

Start a free scan