{"id":"CVE-2026-89090","kind":"vulnerability","aliases":["CVE-2026-89090"],"related":[],"title":"AWS SDK for Go v2: malformed event stream frame crashes host process","description":"CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2\n\n### CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2\n\nBulletin ID: 2026-110-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/11/2026 10:00 AM PDT\n\nDescription:\n\nAn issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating 2026-03-23. An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.\n\nImpacted versions: < 2026-03-23\n\nResolution:\n\nThis issue has been addressed in versions 2026-03-23 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nNot applicable.\n\nReferences:\n\n- CVE-2026-89090\n- GHSA-xmrv-pmrh-hhx2\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The AWS SDK for Go v2 event stream header decoder does not recover from a panic when it receives a crafted header value type byte outside the valid range. An attacker who can send a malformed EventStream response frame can terminate the host process, causing denial of service.","severity":"high","cvss":8.2,"epss":0.00305,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","aws-sdk-go-v2","go","lab-disclosure","package"],"not_affected_if":["release-2026-03-23-or-later"],"how_to_check":"- Check the SDK version in `go.mod` for `github.com/aws/aws-sdk-go-v2` and related service modules, and compare against `2026-03-23`\n- Look for code that consumes EventStream responses (for example Transcribe streaming, S3 Select, or Kinesis subscribe-to-shard) and confirm which modules are in use","fix":"- Upgrade the AWS SDK for Go v2 to release `2026-03-23` or later\n- Patch any forked or vendored copies of the event stream decoder to include the upstream fix","status":"open","published_at":"2026-09-11T18:17:00+00:00","first_seen_at":"2026-10-24T18:43:45+00:00","triaged_at":"2026-10-25T05:29:41+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:29:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the AWS SDK for Go v2 to release `2026-03-23` or later\n- Patch any forked or vendored copies of the event stream decoder to include the upstream fix","reach":"network","title":"AWS SDK for Go v2: malformed event stream frame crashes host process","impact":"low","summary":"The AWS SDK for Go v2 event stream header decoder does not recover from a panic when it receives a crafted header value type byte outside the valid range. An attacker who can send a malformed EventStream response frame can terminate the host process, causing denial of service.","category":"package","nicknames":[],"who_cares":["go","aws","aws-sdk-go-v2"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Host process terminates, causing denial of service","analyst_note":"","how_to_check":"- Check the SDK version in `go.mod` for `github.com/aws/aws-sdk-go-v2` and related service modules, and compare against `2026-03-23`\n- Look for code that consumes EventStream responses (for example Transcribe streaming, S3 Select, or Kinesis subscribe-to-shard) and confirm which modules are in use","needs_analyst":false,"not_affected_if":["release-2026-03-23-or-later"],"who_is_affected":"Applications built with AWS SDK for Go v2 releases before `2026-03-23` that receive EventStream responses from a remote source are exposed. Services that only make ordinary request/response calls to AWS and never parse event stream frames are less likely to be reached, but the bulletin does not say which APIs are affected, so teams should upgrade rather than assess per API.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000671,"input_tokens":3703,"output_tokens":601,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-03':153C,186C,197C '-110':117C '-2026':14A,17A,79C,97C,227C '-23':154C,187C,198C '-89090':15A,18A,80C,98C,228C '00':130C '09/11/2026':128C '10':129C '2026':116C,152C,185C,196C 'actor':156C 'address':193C 'applic':224C 'attack':60B 'attent':125C 'aw':1A,19B,21B,31B,91C,109C,118C,120C,144C 'aws-sdk-go-v2':20B 'aws-security@amazon.com':236C 'bulletin':114C 'byte':54B,170C 'caus':74B,177C 'code':214C 'concern':242C 'contain':164C 'content':121C 'craft':50B,166C 'crash':10A 'cve':13A,16A,78C,96C,226C 'date':127C 'decod':39B,89C,107C,142C 'denial':75B,81C,99C 'deriv':213C 'descript':133C 'disclosur':28B 'email':235C 'ensur':209C 'event':7A,36B,86C,104C 'eventstream':66B,140C,161C 'exist':136C 'fix':221C 'fork':211C 'frame':9A,68B,163C 'ghsa':230C 'ghsa-xmrv-pmrh-hhx2':229C 'go':4A,23B,25B,34B,94C,112C,147C 'header':38B,51B,88C,106C,141C,167C 'hhx2':233C 'host':11A,72B,179C 'id':115C 'impact':183C 'import':123C 'incorpor':218C 'issu':135C,190C 'lab':27B 'lab-disclosur':26B 'latest':206C 'malform':6A,65B,160C 'new':220C 'outsid':55B,171C 'packag':29B 'panic':45B 'patch':216C 'pdt':132C 'pleas':234C 'pmrh':232C 'predat':151C 'process':12A,73B,180C 'public':126C 'question':240C 'rang':58B,174C 'receiv':48B 'recommend':202C 'recov':42B 'refer':225C 'requir':124C 'resolut':188C 'respons':67B,162C 'scope':119C 'sdk':2A,22B,32B,92C,110C,145C 'secur':239C 'send':63B,158C 'servic':77B,83C,101C 'stream':8A,37B,87C,105C 'termin':70B,182C 'type':53B,122C,169C 'upgrad':203C 'v2':5A,24B,35B,95C,113C,148C 'valid':57B,173C 'valu':52B,168C 'version':150C,184C,195C,207C 'workaround':222C 'xmrv':231C","nicknames":[],"mitigations":[],"who_affected":"Applications built with AWS SDK for Go v2 releases before `2026-03-23` that receive EventStream responses from a remote source are exposed. Services that only make ordinary request/response calls to AWS and never parse event stream frames are less likely to be reached, but the bulletin does not say which APIs are affected, so teams should upgrade rather than assess per API.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-11T18:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-110-aws/#CVE-2026-89090","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-110-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"AWS: CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2"},{"source":"nvd","external_id":"CVE-2026-89090","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89090","severity":null,"published_at":"2026-09-11T18:17:00+00:00","modified_at":"2026-09-11T20:19:22+00:00","first_seen_at":"2026-10-24T18:53:56+00:00","fetched_at":"2026-10-24T18:53:56+00:00","note":null},{"source":"epss","external_id":"CVE-2026-89090","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89090","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2882,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-110-aws/","title":"AWS: CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2","kind":"advisory","source":"lab","text":"CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2\n\n### CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2\n\nBulletin ID: 2026-110-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/11/2026 10:00 AM PDT\n\nDescription:\n\nAn issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating 2026-03-23. An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.\n\nImpacted versions: < 2026-03-23\n\nResolution:\n\nThis issue has been addressed in versions 2026-03-23 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nNot applicable.\n\nReferences:\n\n- CVE-2026-89090\n- GHSA-xmrv-pmrh-hhx2\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}