--- id: CVE-2026-89090 title: >- An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response … summary: >- An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response … severity: medium cvss: 5.9 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-248 vendor: AWS product: AWS SDK for Go v2 affected: - sdk_for_go_v2 < 2026-03-23 published: '2026-09-11' updated: '2026-09-11' sourceUpdated: '2026-09-11T20:19:22.680' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89090' references: - url: 'https://aws.amazon.com/security/security-bulletins/2026-110-aws/' label: ff89ba41-3aa1-4d27-914a-91399e9639e5 - url: 'https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23' label: ff89ba41-3aa1-4d27-914a-91399e9639e5 - url: >- https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2 label: ff89ba41-3aa1-4d27-914a-91399e9639e5 - url: 'https://github.com/aws/aws-sdk-go-v2' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89090.json - url: 'https://access.redhat.com/security/cve/CVE-2026-89090' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2531982' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89090' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89090' tags: - nvd - cve.org - osv - go - csaf - vex - red-hat ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-09-11T19:19:50.301461Z' ingestedAt: '2026-09-13T23:54:19.110Z' aliases: - GHSA-xmrv-pmrh-hhx2 - GO-2026-5764 ecosystem: go patched: - github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.7.8 - github.com/aws/aws-sdk-go-v2/service/bedrockagentcore 1.15.2 - github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime 1.51.8 - github.com/aws/aws-sdk-go-v2/service/bedrockruntime 1.50.4 - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs 1.65.0 - github.com/aws/aws-sdk-go-v2/service/iotsitewise 1.52.19 - github.com/aws/aws-sdk-go-v2/service/kinesis 1.43.5 - github.com/aws/aws-sdk-go-v2/service/lambda 1.88.5 - github.com/aws/aws-sdk-go-v2/service/lexruntimev2 1.35.15 - github.com/aws/aws-sdk-go-v2/service/s3 1.97.3 - github.com/aws/aws-sdk-go-v2/service/sagemakerruntime 1.39.6 - github.com/aws/aws-sdk-go-v2/service/transcribestreaming 1.34.5 epss: 0.00309 epssPercentile: 0.23949 --- ## Overview An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range. To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2026-89090) Affected packages: - `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream < 1.7.8` - `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore < 1.15.2` - `github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime < 1.51.8` - `github.com/aws/aws-sdk-go-v2/service/bedrockruntime < 1.50.4` - `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs < 1.65.0` - `github.com/aws/aws-sdk-go-v2/service/iotsitewise < 1.52.19` - `github.com/aws/aws-sdk-go-v2/service/kinesis < 1.43.5` - `github.com/aws/aws-sdk-go-v2/service/lambda < 1.88.5` - `github.com/aws/aws-sdk-go-v2/service/lexruntimev2 < 1.35.15` - `github.com/aws/aws-sdk-go-v2/service/s3 < 1.97.3` - `github.com/aws/aws-sdk-go-v2/service/sagemakerruntime < 1.39.6` - `github.com/aws/aws-sdk-go-v2/service/transcribestreaming < 1.34.5` Patched in: - `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.7.8` - `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore 1.15.2` - `github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime 1.51.8` - `github.com/aws/aws-sdk-go-v2/service/bedrockruntime 1.50.4` - `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs 1.65.0` - `github.com/aws/aws-sdk-go-v2/service/iotsitewise 1.52.19` - `github.com/aws/aws-sdk-go-v2/service/kinesis 1.43.5` - `github.com/aws/aws-sdk-go-v2/service/lambda 1.88.5` - `github.com/aws/aws-sdk-go-v2/service/lexruntimev2 1.35.15` - `github.com/aws/aws-sdk-go-v2/service/s3 1.97.3` - `github.com/aws/aws-sdk-go-v2/service/sagemakerruntime 1.39.6` - `github.com/aws/aws-sdk-go-v2/service/transcribestreaming 1.34.5` Source: https://osv.dev/vulnerability/GHSA-xmrv-pmrh-hhx2 ## Vendor advisories - **Red Hat VEX** · Moderate · affected: AWS Load Balancer Operator, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Cryostat 4, Custom Metric Autoscaler operator for Red Hat Openshift, … · no fix planned: AWS Load Balancer Operator, Exploit Intelligence, Logging Subsystem for Red Hat OpenShift, OpenShift API for Data Protection, … · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89090.json)