CVSS 4.0
8.2 highCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NCVE-2026-89090
High (8.2). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.7.8.
An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.
To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.
Severity
CVSS 3.1
5.9 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
- CWE
- CWE-248
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xmrv-pmrh-hhx2 | Go | github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream | <1.7.8 | 1.7.8 |
| GHSA-xmrv-pmrh-hhx2 | Go | github.com/aws/aws-sdk-go-v2/service/bedrockagentcore | <1.15.2 | 1.15.2 |
| GHSA-xmrv-pmrh-hhx2 | Go | github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime | <1.51.8 | 1.51.8 |
| GHSA-xmrv-pmrh-hhx2 | Go | github.com/aws/aws-sdk-go-v2/service/bedrockruntime | <1.50.4 | 1.50.4 |
| GHSA-xmrv-pmrh-hhx2 | Go | github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs | <1.65.0 | 1.65.0 |
| GHSA-xmrv-pmrh-hhx2 | Go | github.com/aws/aws-sdk-go-v2/service/iotsitewise | <1.52.19 | 1.52.19 |
| GHSA-xmrv-pmrh-hhx2 | Go | github.com/aws/aws-sdk-go-v2/service/kinesis | <1.43.5 | 1.43.5 |
| GHSA-xmrv-pmrh-hhx2 | Go | github.com/aws/aws-sdk-go-v2/service/lambda | <1.88.5 | 1.88.5 |
| GHSA-xmrv-pmrh-hhx2 | Go | github.com/aws/aws-sdk-go-v2/service/lexruntimev2 | <1.35.15 | 1.35.15 |
| GHSA-xmrv-pmrh-hhx2 | Go | github.com/aws/aws-sdk-go-v2/service/s3 | <1.97.3 | 1.97.3 |
| GHSA-xmrv-pmrh-hhx2 | Go | github.com/aws/aws-sdk-go-v2/service/sagemakerruntime | <1.39.6 | 1.39.6 |
| GHSA-xmrv-pmrh-hhx2 | Go | github.com/aws/aws-sdk-go-v2/service/transcribestreaming | <1.34.5 | 1.34.5 |
| GO-2026-5764 | Go | github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream | <1.7.8 | 1.7.8 |
| GO-2026-5764 | Go | github.com/aws/aws-sdk-go-v2/service/bedrockagentcore | <1.15.2 | 1.15.2 |
| GO-2026-5764 | Go | github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime | <1.51.8 | 1.51.8 |
| GO-2026-5764 | Go | github.com/aws/aws-sdk-go-v2/service/bedrockruntime | <1.50.4 | 1.50.4 |
| GO-2026-5764 | Go | github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs | <1.65.0 | 1.65.0 |
| GO-2026-5764 | Go | github.com/aws/aws-sdk-go-v2/service/iotsitewise | <1.52.19 | 1.52.19 |
| GO-2026-5764 | Go | github.com/aws/aws-sdk-go-v2/service/kinesis | <1.43.5 | 1.43.5 |
| GO-2026-5764 | Go | github.com/aws/aws-sdk-go-v2/service/lambda | <1.88.5 | 1.88.5 |
| GO-2026-5764 | Go | github.com/aws/aws-sdk-go-v2/service/lexruntimev2 | <1.35.15 | 1.35.15 |
| GO-2026-5764 | Go | github.com/aws/aws-sdk-go-v2/service/s3 | <1.97.3 | 1.97.3 |
| GO-2026-5764 | Go | github.com/aws/aws-sdk-go-v2/service/sagemakerruntime | <1.39.6 | 1.39.6 |
| GO-2026-5764 | Go | github.com/aws/aws-sdk-go-v2/service/transcribestreaming | <1.34.5 | 1.34.5 |