Live › vulnerability › GHSA-xmrv-pmrh-hhx2
Go to dashboardThe EventStream header decoder in AWS SDK for Go v2 does not validate a header value type byte, so a crafted response frame can terminate the process that is reading it. The attacker gets a denial of service, not code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:43 UTC. All times on this page are UTC.
Applications built with AWS SDK for Go v2 versions before that receive event stream responses, since the crash happens while decoding a response frame. Services that only make standard request/response calls and never consume event streams are not on this code path. Teams on or later can skip it.
2026-03-232026-03-23No product ranges from the sources yet.
github.com/aws/aws-sdk-go-v2 in go.mod or go list -m github.com/aws/aws-sdk-go-v2, and confirm whether the code uses event stream APIs (for example Amazon Transcribe streaming, S3 Select, or Kinesis SubscribeToShard)github.com/aws/aws-sdk-go-v2 to 2026-03-23 or later, then rebuild and redeployEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2
Bulletin ID: 2026-110-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/11/2026 10:00 AM PDT
Description:
An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating 2026-03-23. An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.
Impacted versions: < 2026-03-23
Resolution:
This issue has been addressed in versions 2026-03-23 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
Not applicable.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-xmrv-pmrh-hhx2")