How do I check whether I am affected by CVE-2026-89090?

- Check the SDK version in `go.mod` for `github.com/aws/aws-sdk-go-v2` and related service modules, and compare against `2026-03-23` - Look for code that consumes EventStream responses (for example Transcribe streaming, S3 Select, or Kinesis subscribe-to-shard) and confirm which modules are in use

What is the fix for CVE-2026-89090?

- Upgrade the AWS SDK for Go v2 to release `2026-03-23` or later - Patch any forked or vendored copies of the event stream decoder to include the upstream fix

Who is not affected by CVE-2026-89090?

Not affected if: release-2026-03-23-or-later.

Live › vulnerability › CVE-2026-89090

Go to dashboard

high8.2Package

AWS SDK for Go v2: malformed event stream frame crashes host process

The AWS SDK for Go v2 event stream header decoder does not recover from a panic when it receives a crafted header value type byte outside the valid range. An attacker who can send a malformed EventStream response frame can terminate the host process, causing denial of service.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.2

high

scored by ff89ba41-3aa1-4d27-914a-91399e9639e5

known so far5 of 6

missing: versions

First public: Sep 11, 2026 UTC
Last modified: Sep 11, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-24 18:43 UTC, 0h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Host process terminates, causing denial of service.
CVSS said: 8.2. The facts above say low; we keep the sources' high until an analyst looks.

Who is affected

Applications built with AWS SDK for Go v2 releases before that receive EventStream responses from a remote source are exposed. Services that only make ordinary request/response calls to AWS and never parse event stream frames are less likely to be reached, but the bulletin does not say which APIs are affected, so teams should upgrade rather than assess per API.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-89090

Go to dashboard

high8.2Package

AWS SDK for Go v2: malformed event stream frame crashes host process

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.2

high

scored by ff89ba41-3aa1-4d27-914a-91399e9639e5

known so far5 of 6

missing: versions

First public: Sep 11, 2026 UTC
Last modified: Sep 11, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-24 18:43 UTC, 0h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Host process terminates, causing denial of service.
CVSS said: 8.2. The facts above say low; we keep the sources' high until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

AWS SDK for Go v2: malformed event stream frame crashes host process

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

AWS SDK for Go v2: malformed event stream frame crashes host process

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2

Sources