{"id":"GHSA-xmrv-pmrh-hhx2","kind":"vulnerability","aliases":["GHSA-xmrv-pmrh-hhx2"],"related":[],"title":"CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2","description":"CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2\n\n### CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2\n\nBulletin ID: 2026-110-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/11/2026 10:00 AM PDT\n\nDescription:\n\nAn issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating 2026-03-23. An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.\n\nImpacted versions: < 2026-03-23\n\nResolution:\n\nThis issue has been addressed in versions 2026-03-23 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nNot applicable.\n\nReferences:\n\n- CVE-2026-89090\n- GHSA-xmrv-pmrh-hhx2\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The EventStream header decoder in AWS SDK for Go v2 does not validate a header value type byte, so a crafted response frame can terminate the process that is reading it. The attacker gets a denial of service, not code execution.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","aws-sdk-go-v2","event-stream","go","lab-disclosure","package"],"not_affected_if":["no-event-streams","patched-sdk"],"how_to_check":"- Check the version of `github.com/aws/aws-sdk-go-v2` in `go.mod` or `go list -m github.com/aws/aws-sdk-go-v2`, and confirm whether the code uses event stream APIs (for example Amazon Transcribe streaming, S3 Select, or Kinesis SubscribeToShard)","fix":"- Upgrade `github.com/aws/aws-sdk-go-v2` to `2026-03-23` or later, then rebuild and redeploy\n- Patch any forked or vendored copy of the SDK's event stream decoder","status":"open","published_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","triaged_at":"2026-10-25T04:51:45+00:00","updated_at":"2026-10-25T04:51:45+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:51:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `github.com/aws/aws-sdk-go-v2` to `2026-03-23` or later, then rebuild and redeploy\n- Patch any forked or vendored copy of the SDK's event stream decoder","reach":"unknown","title":"AWS SDK for Go v2: malformed event stream frame crashes the host process","impact":"low","summary":"The EventStream header decoder in AWS SDK for Go v2 does not validate a header value type byte, so a crafted response frame can terminate the process that is reading it. The attacker gets a denial of service, not code execution.","category":"package","nicknames":[],"who_cares":["go","aws-sdk-go-v2","aws","event-stream"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Host process terminates on a malformed event stream frame","analyst_note":"","how_to_check":"- Check the version of `github.com/aws/aws-sdk-go-v2` in `go.mod` or `go list -m github.com/aws/aws-sdk-go-v2`, and confirm whether the code uses event stream APIs (for example Amazon Transcribe streaming, S3 Select, or Kinesis SubscribeToShard)","needs_analyst":false,"not_affected_if":["no-event-streams","patched-sdk"],"who_is_affected":"Applications built with AWS SDK for Go v2 versions before `2026-03-23` that receive event stream responses, since the crash happens while decoding a response frame. Services that only make standard request/response calls and never consume event streams are not on this code path. Teams on `2026-03-23` or later can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000663,"input_tokens":3674,"output_tokens":591,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-03':159C,192C,203C '-110':123C '-2026':2A,85C,103C,233C '-23':160C,193C,204C '-89090':3A,86C,104C,234C '00':136C '09/11/2026':134C '10':135C '2026':122C,158C,191C,202C 'actor':162C 'address':199C 'applic':230C 'attack':75B 'attent':131C 'aw':14A,29B,31B,48B,97C,115C,124C,126C,150C 'aws-sdk-go-v2':30B 'aws-security@amazon.com':242C 'bulletin':120C 'byte':60B,176C 'caus':183C 'code':82B,220C 'concern':248C 'contain':170C 'content':127C 'craft':63B,172C 'cve':1A,84C,102C,232C 'date':133C 'decod':12A,46B,95C,113C,148C 'denial':4A,78B,87C,105C 'deriv':219C 'descript':139C 'disclosur':41B 'email':241C 'ensur':215C 'event':9A,36B,92C,110C 'event-stream':35B 'eventstream':44B,146C,167C 'execut':83B 'exist':142C 'fix':227C 'fork':217C 'frame':65B,169C 'get':76B 'ghsa':20A,25A,236C 'ghsa-xmrv-pmrh-hhx2':19A,24A,235C 'go':17A,33B,38B,51B,100C,118C,153C 'header':11A,45B,57B,94C,112C,147C,173C 'hhx2':23A,28A,239C 'host':185C 'id':121C 'impact':189C 'import':129C 'incorpor':224C 'issu':141C,196C 'lab':40B 'lab-disclosur':39B 'latest':212C 'malform':166C 'new':226C 'outsid':177C 'packag':42B 'patch':222C 'pdt':138C 'pleas':240C 'pmrh':22A,27A,238C 'predat':157C 'process':69B,186C 'public':132C 'question':246C 'rang':180C 'read':72B 'recommend':208C 'refer':231C 'requir':130C 'resolut':194C 'respons':64B,168C 'scope':125C 'sdk':15A,32B,49B,98C,116C,151C 'secur':245C 'send':164C 'servic':6A,80B,89C,107C 'stream':10A,37B,93C,111C 'termin':67B,188C 'type':59B,128C,175C 'upgrad':209C 'v2':18A,34B,52B,101C,119C,154C 'valid':55B,179C 'valu':58B,174C 'version':156C,190C,201C,213C 'workaround':228C 'xmrv':21A,26A,237C","nicknames":[],"mitigations":[],"who_affected":"Applications built with AWS SDK for Go v2 versions before `2026-03-23` that receive event stream responses, since the crash happens while decoding a response frame. Services that only make standard request/response calls and never consume event streams are not on this code path. Teams on `2026-03-23` or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":null,"kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-110-aws/#GHSA-xmrv-pmrh-hhx2","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-110-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"AWS: CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2"}],"documents":[{"id":2882,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-110-aws/","title":"AWS: CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2","kind":"advisory","source":"lab","text":"CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2\n\n### CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2\n\nBulletin ID: 2026-110-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/11/2026 10:00 AM PDT\n\nDescription:\n\nAn issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating 2026-03-23. An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.\n\nImpacted versions: < 2026-03-23\n\nResolution:\n\nThis issue has been addressed in versions 2026-03-23 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nNot applicable.\n\nReferences:\n\n- CVE-2026-89090\n- GHSA-xmrv-pmrh-hhx2\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}