---
id: GO-2026-5764
aliases:
  - GHSA-xmrv-pmrh-hhx2
title: >-
  DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in
  github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
summary: >-
  DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in
  github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
severity: none
vendor: aws
product: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
ecosystem: go
affected:
  - github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream < 1.7.8
  - github.com/aws/aws-sdk-go-v2/service/bedrockagentcore < 1.15.2
  - github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime < 1.51.8
  - github.com/aws/aws-sdk-go-v2/service/bedrockruntime < 1.50.4
  - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs < 1.65.0
  - github.com/aws/aws-sdk-go-v2/service/iotsitewise < 1.52.19
  - github.com/aws/aws-sdk-go-v2/service/kinesis < 1.43.5
  - github.com/aws/aws-sdk-go-v2/service/lambda < 1.88.5
  - github.com/aws/aws-sdk-go-v2/service/lexruntimev2 < 1.35.15
  - github.com/aws/aws-sdk-go-v2/service/s3 < 1.97.3
  - github.com/aws/aws-sdk-go-v2/service/sagemakerruntime < 1.39.6
  - github.com/aws/aws-sdk-go-v2/service/transcribestreaming < 1.34.5
patched:
  - github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.7.8
  - github.com/aws/aws-sdk-go-v2/service/bedrockagentcore 1.15.2
  - github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime 1.51.8
  - github.com/aws/aws-sdk-go-v2/service/bedrockruntime 1.50.4
  - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs 1.65.0
  - github.com/aws/aws-sdk-go-v2/service/iotsitewise 1.52.19
  - github.com/aws/aws-sdk-go-v2/service/kinesis 1.43.5
  - github.com/aws/aws-sdk-go-v2/service/lambda 1.88.5
  - github.com/aws/aws-sdk-go-v2/service/lexruntimev2 1.35.15
  - github.com/aws/aws-sdk-go-v2/service/s3 1.97.3
  - github.com/aws/aws-sdk-go-v2/service/sagemakerruntime 1.39.6
  - github.com/aws/aws-sdk-go-v2/service/transcribestreaming 1.34.5
published: '2026-07-07'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-5764'
references:
  - url: >-
      https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2
  - url: 'https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23'
tags:
  - osv
  - go
ingestedAt: '2026-07-09T18:56:37.246Z'
---

## Overview

DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream

## Affected packages

- `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream < 1.7.8`
- `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore < 1.15.2`
- `github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime < 1.51.8`
- `github.com/aws/aws-sdk-go-v2/service/bedrockruntime < 1.50.4`
- `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs < 1.65.0`
- `github.com/aws/aws-sdk-go-v2/service/iotsitewise < 1.52.19`
- `github.com/aws/aws-sdk-go-v2/service/kinesis < 1.43.5`
- `github.com/aws/aws-sdk-go-v2/service/lambda < 1.88.5`
- `github.com/aws/aws-sdk-go-v2/service/lexruntimev2 < 1.35.15`
- `github.com/aws/aws-sdk-go-v2/service/s3 < 1.97.3`
- `github.com/aws/aws-sdk-go-v2/service/sagemakerruntime < 1.39.6`
- `github.com/aws/aws-sdk-go-v2/service/transcribestreaming < 1.34.5`

## Remediation

Upgrade to a patched release:

- `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.7.8`
- `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore 1.15.2`
- `github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime 1.51.8`
- `github.com/aws/aws-sdk-go-v2/service/bedrockruntime 1.50.4`
- `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs 1.65.0`
- `github.com/aws/aws-sdk-go-v2/service/iotsitewise 1.52.19`
- `github.com/aws/aws-sdk-go-v2/service/kinesis 1.43.5`
- `github.com/aws/aws-sdk-go-v2/service/lambda 1.88.5`
- `github.com/aws/aws-sdk-go-v2/service/lexruntimev2 1.35.15`
- `github.com/aws/aws-sdk-go-v2/service/s3 1.97.3`
- `github.com/aws/aws-sdk-go-v2/service/sagemakerruntime 1.39.6`
- `github.com/aws/aws-sdk-go-v2/service/transcribestreaming 1.34.5`