{"id":"GHSA-xmrv-pmrh-hhx2","summary":"Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder","details":"**CVSSv3.1 Rating**: [Medium]\n**CVSSv3.1 Score**: [5.9]\n**CVSSv3.1 Vector String**: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]\n\n## Summary and Impact\nAn issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23). An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.\n\nImpacted versions: \u003c [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23)\n\n## Patches\nThis issue has been addressed in versions [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23) and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. \n\n## Workarounds\nNot Applicable\n\n## References\nIf you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.","aliases":["CVE-2026-89090","GO-2026-5764"],"modified":"2026-09-12T04:10:36.910182480Z","published":"2026-04-08T00:18:56Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-04-08T00:18:56Z","nvd_published_at":null,"cwe_ids":["CWE-20"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2"},{"type":"PACKAGE","url":"https://github.com/aws/aws-sdk-go-v2"},{"type":"WEB","url":"https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23"}],"affected":[{"package":{"name":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.8"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/bedrockagentcore","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/bedrockagentcore"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.51.8"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/bedrockruntime","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/bedrockruntime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.50.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.65.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/iotsitewise","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/iotsitewise"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.52.19"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/kinesis","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/kinesis"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.43.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/lambda","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/lambda"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.88.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/lexruntimev2","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/lexruntimev2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.35.15"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/s3","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/s3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.97.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/sagemakerruntime","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/sagemakerruntime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.39.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/transcribestreaming","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/transcribestreaming"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.34.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmrv-pmrh-hhx2/GHSA-xmrv-pmrh-hhx2.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}