---
id: GHSA-xmrv-pmrh-hhx2
aliases:
  - GO-2026-5764
title: Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
summary: Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: aws
product: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
ecosystem: go
affected:
  - github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream < 1.7.8
  - github.com/aws/aws-sdk-go-v2/service/bedrockagentcore < 1.15.2
  - github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime < 1.51.8
  - github.com/aws/aws-sdk-go-v2/service/bedrockruntime < 1.50.4
  - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs < 1.65.0
  - github.com/aws/aws-sdk-go-v2/service/iotsitewise < 1.52.19
  - github.com/aws/aws-sdk-go-v2/service/kinesis < 1.43.5
  - github.com/aws/aws-sdk-go-v2/service/lambda < 1.88.5
  - github.com/aws/aws-sdk-go-v2/service/lexruntimev2 < 1.35.15
  - github.com/aws/aws-sdk-go-v2/service/s3 < 1.97.3
  - github.com/aws/aws-sdk-go-v2/service/sagemakerruntime < 1.39.6
  - github.com/aws/aws-sdk-go-v2/service/transcribestreaming < 1.34.5
patched:
  - github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.7.8
  - github.com/aws/aws-sdk-go-v2/service/bedrockagentcore 1.15.2
  - github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime 1.51.8
  - github.com/aws/aws-sdk-go-v2/service/bedrockruntime 1.50.4
  - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs 1.65.0
  - github.com/aws/aws-sdk-go-v2/service/iotsitewise 1.52.19
  - github.com/aws/aws-sdk-go-v2/service/kinesis 1.43.5
  - github.com/aws/aws-sdk-go-v2/service/lambda 1.88.5
  - github.com/aws/aws-sdk-go-v2/service/lexruntimev2 1.35.15
  - github.com/aws/aws-sdk-go-v2/service/s3 1.97.3
  - github.com/aws/aws-sdk-go-v2/service/sagemakerruntime 1.39.6
  - github.com/aws/aws-sdk-go-v2/service/transcribestreaming 1.34.5
published: '2026-04-08'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-xmrv-pmrh-hhx2'
references:
  - url: >-
      https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2
  - url: 'https://github.com/aws/aws-sdk-go-v2'
  - url: 'https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23'
tags:
  - osv
  - go
ingestedAt: '2026-07-09T18:56:36.989Z'
---

## Overview

**CVSSv3.1 Rating**: [Medium]
**CVSSv3.1 Score**: [5.9]
**CVSSv3.1 Vector String**: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]

## Summary and Impact
An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23). An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.

Impacted versions: < [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23)

## Patches
This issue has been addressed in versions [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23) and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. 

## Workarounds
Not Applicable

## References
If you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.

## Affected packages

- `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream < 1.7.8`
- `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore < 1.15.2`
- `github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime < 1.51.8`
- `github.com/aws/aws-sdk-go-v2/service/bedrockruntime < 1.50.4`
- `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs < 1.65.0`
- `github.com/aws/aws-sdk-go-v2/service/iotsitewise < 1.52.19`
- `github.com/aws/aws-sdk-go-v2/service/kinesis < 1.43.5`
- `github.com/aws/aws-sdk-go-v2/service/lambda < 1.88.5`
- `github.com/aws/aws-sdk-go-v2/service/lexruntimev2 < 1.35.15`
- `github.com/aws/aws-sdk-go-v2/service/s3 < 1.97.3`
- `github.com/aws/aws-sdk-go-v2/service/sagemakerruntime < 1.39.6`
- `github.com/aws/aws-sdk-go-v2/service/transcribestreaming < 1.34.5`

## Remediation

Upgrade to a patched release:

- `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.7.8`
- `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore 1.15.2`
- `github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime 1.51.8`
- `github.com/aws/aws-sdk-go-v2/service/bedrockruntime 1.50.4`
- `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs 1.65.0`
- `github.com/aws/aws-sdk-go-v2/service/iotsitewise 1.52.19`
- `github.com/aws/aws-sdk-go-v2/service/kinesis 1.43.5`
- `github.com/aws/aws-sdk-go-v2/service/lambda 1.88.5`
- `github.com/aws/aws-sdk-go-v2/service/lexruntimev2 1.35.15`
- `github.com/aws/aws-sdk-go-v2/service/s3 1.97.3`
- `github.com/aws/aws-sdk-go-v2/service/sagemakerruntime 1.39.6`
- `github.com/aws/aws-sdk-go-v2/service/transcribestreaming 1.34.5`