{"id":"GHSA-xmrv-pmrh-hhx2","aliases":["GO-2026-5764"],"title":"Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder","summary":"Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"aws","product":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","ecosystem":"go","affected":["github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream < 1.7.8","github.com/aws/aws-sdk-go-v2/service/bedrockagentcore < 1.15.2","github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime < 1.51.8","github.com/aws/aws-sdk-go-v2/service/bedrockruntime < 1.50.4","github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs < 1.65.0","github.com/aws/aws-sdk-go-v2/service/iotsitewise < 1.52.19","github.com/aws/aws-sdk-go-v2/service/kinesis < 1.43.5","github.com/aws/aws-sdk-go-v2/service/lambda < 1.88.5","github.com/aws/aws-sdk-go-v2/service/lexruntimev2 < 1.35.15","github.com/aws/aws-sdk-go-v2/service/s3 < 1.97.3","github.com/aws/aws-sdk-go-v2/service/sagemakerruntime < 1.39.6","github.com/aws/aws-sdk-go-v2/service/transcribestreaming < 1.34.5"],"patched":["github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.7.8","github.com/aws/aws-sdk-go-v2/service/bedrockagentcore 1.15.2","github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime 1.51.8","github.com/aws/aws-sdk-go-v2/service/bedrockruntime 1.50.4","github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs 1.65.0","github.com/aws/aws-sdk-go-v2/service/iotsitewise 1.52.19","github.com/aws/aws-sdk-go-v2/service/kinesis 1.43.5","github.com/aws/aws-sdk-go-v2/service/lambda 1.88.5","github.com/aws/aws-sdk-go-v2/service/lexruntimev2 1.35.15","github.com/aws/aws-sdk-go-v2/service/s3 1.97.3","github.com/aws/aws-sdk-go-v2/service/sagemakerruntime 1.39.6","github.com/aws/aws-sdk-go-v2/service/transcribestreaming 1.34.5"],"published":"2026-04-08","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-xmrv-pmrh-hhx2","references":[{"url":"https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2"},{"url":"https://github.com/aws/aws-sdk-go-v2"},{"url":"https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23"}],"tags":["osv","go"],"ingestedAt":"2026-07-09T18:56:36.989Z","slug":"GHSA-xmrv-pmrh-hhx2","body":"## Overview\n\n**CVSSv3.1 Rating**: [Medium]\n**CVSSv3.1 Score**: [5.9]\n**CVSSv3.1 Vector String**: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]\n\n## Summary and Impact\nAn issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23). An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.\n\nImpacted versions: < [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23)\n\n## Patches\nThis issue has been addressed in versions [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23) and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. \n\n## Workarounds\nNot Applicable\n\n## References\nIf you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n## Affected packages\n\n- `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream < 1.7.8`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore < 1.15.2`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime < 1.51.8`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockruntime < 1.50.4`\n- `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs < 1.65.0`\n- `github.com/aws/aws-sdk-go-v2/service/iotsitewise < 1.52.19`\n- `github.com/aws/aws-sdk-go-v2/service/kinesis < 1.43.5`\n- `github.com/aws/aws-sdk-go-v2/service/lambda < 1.88.5`\n- `github.com/aws/aws-sdk-go-v2/service/lexruntimev2 < 1.35.15`\n- `github.com/aws/aws-sdk-go-v2/service/s3 < 1.97.3`\n- `github.com/aws/aws-sdk-go-v2/service/sagemakerruntime < 1.39.6`\n- `github.com/aws/aws-sdk-go-v2/service/transcribestreaming < 1.34.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.7.8`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore 1.15.2`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime 1.51.8`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockruntime 1.50.4`\n- `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs 1.65.0`\n- `github.com/aws/aws-sdk-go-v2/service/iotsitewise 1.52.19`\n- `github.com/aws/aws-sdk-go-v2/service/kinesis 1.43.5`\n- `github.com/aws/aws-sdk-go-v2/service/lambda 1.88.5`\n- `github.com/aws/aws-sdk-go-v2/service/lexruntimev2 1.35.15`\n- `github.com/aws/aws-sdk-go-v2/service/s3 1.97.3`\n- `github.com/aws/aws-sdk-go-v2/service/sagemakerruntime 1.39.6`\n- `github.com/aws/aws-sdk-go-v2/service/transcribestreaming 1.34.5`","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}