{"id":"GO-2026-5764","aliases":["GHSA-xmrv-pmrh-hhx2"],"title":"DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","summary":"DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","severity":"none","vendor":"aws","product":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","ecosystem":"go","affected":["github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream < 1.7.8","github.com/aws/aws-sdk-go-v2/service/bedrockagentcore < 1.15.2","github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime < 1.51.8","github.com/aws/aws-sdk-go-v2/service/bedrockruntime < 1.50.4","github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs < 1.65.0","github.com/aws/aws-sdk-go-v2/service/iotsitewise < 1.52.19","github.com/aws/aws-sdk-go-v2/service/kinesis < 1.43.5","github.com/aws/aws-sdk-go-v2/service/lambda < 1.88.5","github.com/aws/aws-sdk-go-v2/service/lexruntimev2 < 1.35.15","github.com/aws/aws-sdk-go-v2/service/s3 < 1.97.3","github.com/aws/aws-sdk-go-v2/service/sagemakerruntime < 1.39.6","github.com/aws/aws-sdk-go-v2/service/transcribestreaming < 1.34.5"],"patched":["github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.7.8","github.com/aws/aws-sdk-go-v2/service/bedrockagentcore 1.15.2","github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime 1.51.8","github.com/aws/aws-sdk-go-v2/service/bedrockruntime 1.50.4","github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs 1.65.0","github.com/aws/aws-sdk-go-v2/service/iotsitewise 1.52.19","github.com/aws/aws-sdk-go-v2/service/kinesis 1.43.5","github.com/aws/aws-sdk-go-v2/service/lambda 1.88.5","github.com/aws/aws-sdk-go-v2/service/lexruntimev2 1.35.15","github.com/aws/aws-sdk-go-v2/service/s3 1.97.3","github.com/aws/aws-sdk-go-v2/service/sagemakerruntime 1.39.6","github.com/aws/aws-sdk-go-v2/service/transcribestreaming 1.34.5"],"published":"2026-07-07","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-5764","references":[{"url":"https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2"},{"url":"https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23"}],"tags":["osv","go"],"ingestedAt":"2026-07-09T18:56:37.246Z","slug":"GO-2026-5764","body":"## Overview\n\nDoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream\n\n## Affected packages\n\n- `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream < 1.7.8`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore < 1.15.2`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime < 1.51.8`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockruntime < 1.50.4`\n- `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs < 1.65.0`\n- `github.com/aws/aws-sdk-go-v2/service/iotsitewise < 1.52.19`\n- `github.com/aws/aws-sdk-go-v2/service/kinesis < 1.43.5`\n- `github.com/aws/aws-sdk-go-v2/service/lambda < 1.88.5`\n- `github.com/aws/aws-sdk-go-v2/service/lexruntimev2 < 1.35.15`\n- `github.com/aws/aws-sdk-go-v2/service/s3 < 1.97.3`\n- `github.com/aws/aws-sdk-go-v2/service/sagemakerruntime < 1.39.6`\n- `github.com/aws/aws-sdk-go-v2/service/transcribestreaming < 1.34.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.7.8`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore 1.15.2`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime 1.51.8`\n- `github.com/aws/aws-sdk-go-v2/service/bedrockruntime 1.50.4`\n- `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs 1.65.0`\n- `github.com/aws/aws-sdk-go-v2/service/iotsitewise 1.52.19`\n- `github.com/aws/aws-sdk-go-v2/service/kinesis 1.43.5`\n- `github.com/aws/aws-sdk-go-v2/service/lambda 1.88.5`\n- `github.com/aws/aws-sdk-go-v2/service/lexruntimev2 1.35.15`\n- `github.com/aws/aws-sdk-go-v2/service/s3 1.97.3`\n- `github.com/aws/aws-sdk-go-v2/service/sagemakerruntime 1.39.6`\n- `github.com/aws/aws-sdk-go-v2/service/transcribestreaming 1.34.5`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}