{"id":"CVE-2026-89090","title":"An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response …","summary":"An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response …","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-248"],"vendor":"AWS","product":"AWS SDK for Go v2","affected":["sdk_for_go_v2 < 2026-03-23"],"published":"2026-09-11","updated":"2026-09-11","sourceUpdated":"2026-09-11T20:19:22.680","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89090","references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-110-aws/","label":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23","label":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2","label":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/aws/aws-sdk-go-v2"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89090.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89090"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531982"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89090"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89090"}],"tags":["nvd","cve.org","osv","go","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-11T19:19:50.301461Z"},"ingestedAt":"2026-09-13T23:54:19.110Z","aliases":["GHSA-xmrv-pmrh-hhx2","GO-2026-5764"],"ecosystem":"go","patched":["github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.7.8","github.com/aws/aws-sdk-go-v2/service/bedrockagentcore 1.15.2","github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime 1.51.8","github.com/aws/aws-sdk-go-v2/service/bedrockruntime 1.50.4","github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs 1.65.0","github.com/aws/aws-sdk-go-v2/service/iotsitewise 1.52.19","github.com/aws/aws-sdk-go-v2/service/kinesis 1.43.5","github.com/aws/aws-sdk-go-v2/service/lambda 1.88.5","github.com/aws/aws-sdk-go-v2/service/lexruntimev2 1.35.15","github.com/aws/aws-sdk-go-v2/service/s3 1.97.3","github.com/aws/aws-sdk-go-v2/service/sagemakerruntime 1.39.6","github.com/aws/aws-sdk-go-v2/service/transcribestreaming 1.34.5"],"epss":0.00309,"epssPercentile":0.23881,"slug":"CVE-2026-89090","body":"## Overview\n\nAn unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.\n\n\n\nTo remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-89090)\n\nAffected packages:\n\n- `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream < 1.7.8`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore < 1.15.2`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime < 1.51.8`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockruntime < 1.50.4`\n- `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs < 1.65.0`\n- `github.com/aws/aws-sdk-go-v2/service/iotsitewise < 1.52.19`\n- `github.com/aws/aws-sdk-go-v2/service/kinesis < 1.43.5`\n- `github.com/aws/aws-sdk-go-v2/service/lambda < 1.88.5`\n- `github.com/aws/aws-sdk-go-v2/service/lexruntimev2 < 1.35.15`\n- `github.com/aws/aws-sdk-go-v2/service/s3 < 1.97.3`\n- `github.com/aws/aws-sdk-go-v2/service/sagemakerruntime < 1.39.6`\n- `github.com/aws/aws-sdk-go-v2/service/transcribestreaming < 1.34.5`\n\nPatched in:\n\n- `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.7.8`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore 1.15.2`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime 1.51.8`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockruntime 1.50.4`\n- `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs 1.65.0`\n- `github.com/aws/aws-sdk-go-v2/service/iotsitewise 1.52.19`\n- `github.com/aws/aws-sdk-go-v2/service/kinesis 1.43.5`\n- `github.com/aws/aws-sdk-go-v2/service/lambda 1.88.5`\n- `github.com/aws/aws-sdk-go-v2/service/lexruntimev2 1.35.15`\n- `github.com/aws/aws-sdk-go-v2/service/s3 1.97.3`\n- `github.com/aws/aws-sdk-go-v2/service/sagemakerruntime 1.39.6`\n- `github.com/aws/aws-sdk-go-v2/service/transcribestreaming 1.34.5`\n\nSource: https://osv.dev/vulnerability/GHSA-xmrv-pmrh-hhx2\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: AWS Load Balancer Operator, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Cryostat 4, Custom Metric Autoscaler operator for Red Hat Openshift, … · no fix planned: AWS Load Balancer Operator, Exploit Intelligence, Logging Subsystem for Red Hat OpenShift, OpenShift API for Data Protection, … · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89090.json)","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}