{"id":"CVE-2026-89090","aliases":["GHSA-xmrv-pmrh-hhx2","GO-2026-5764"],"url":"https://o3.security/vulnerability/CVE-2026-89090","summary":"Denial of service in the event stream header decoder in AWS SDK for Go v2","details":"**CVSSv3.1 Rating**: [Medium]\n**CVSSv3.1 Score**: [5.9]\n**CVSSv3.1 Vector String**: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]\n\n## Summary and Impact\nAn issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23). An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.\n\nImpacted versions: < [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23)\n\n## Patches\nThis issue has been addressed in versions [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23) and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. \n\n## Workarounds\nNot Applicable\n\n## References\nIf you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.","published":"2026-09-11T17:03:33.351Z","modified":"2026-11-04T14:27:28.320643480Z","cvss":null,"epss":{"score":0.00309,"percentile":0.23723,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","fixedVersion":"1.7.8"},{"ecosystem":"Go","name":"github.com/aws/aws-sdk-go-v2/service/bedrockagentcore","fixedVersion":"1.15.2"},{"ecosystem":"Go","name":"github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime","fixedVersion":"1.51.8"},{"ecosystem":"Go","name":"github.com/aws/aws-sdk-go-v2/service/bedrockruntime","fixedVersion":"1.50.4"},{"ecosystem":"Go","name":"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs","fixedVersion":"1.65.0"},{"ecosystem":"Go","name":"github.com/aws/aws-sdk-go-v2/service/iotsitewise","fixedVersion":"1.52.19"},{"ecosystem":"Go","name":"github.com/aws/aws-sdk-go-v2/service/kinesis","fixedVersion":"1.43.5"},{"ecosystem":"Go","name":"github.com/aws/aws-sdk-go-v2/service/lambda","fixedVersion":"1.88.5"},{"ecosystem":"Go","name":"github.com/aws/aws-sdk-go-v2/service/lexruntimev2","fixedVersion":"1.35.15"},{"ecosystem":"Go","name":"github.com/aws/aws-sdk-go-v2/service/s3","fixedVersion":"1.97.3"},{"ecosystem":"Go","name":"github.com/aws/aws-sdk-go-v2/service/sagemakerruntime","fixedVersion":"1.39.6"},{"ecosystem":"Go","name":"github.com/aws/aws-sdk-go-v2/service/transcribestreaming","fixedVersion":"1.34.5"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://aws.amazon.com/security/security-bulletins/2026-110-aws/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89090.json"},{"type":"ADVISORY","url":"https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89090"},{"type":"FIX","url":"https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23"},{"type":"PACKAGE","url":"https://github.com/aws/aws-sdk-go-v2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-04T14:27:28.320643480Z"}}