CVE-2026-89090

Denial of service in the event stream header decoder in AWS SDK for Go v2

Published Sep 11, 2026 CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Description

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.

To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.

Analysis

Technical impact

The vulnerability is an unrecovered panic triggered by the event stream header decoder when it encounters a header value type outside the expected range. The panic crashes the consuming application, effectively denying service to legitimate users. This weakness is an uncaught exception, classified as CWE‑248. The problem exists in all builds of AWS SDK for Go v2 prior to release‑2026‑03‑23 and can be exploited by sending a crafted event stream response frame.

Affected Systems

AWS SDK for Go v2 is impacted. Any project or derivative fork that incorporates the SDK before release‑2026‑03‑23 is vulnerable. The affected code base includes the event stream header decoding logic for all releases before the mentioned version.

Risk and Exploitability

The CVSS score of 8.2 denotes high severity. EPSS indicates a very low probability of exploitation, though not zero. The attack is remote, unauthenticated, and requires that an attacker can inject a malicious event stream response frame with an invalid header type. No additional prerequisites are necessary beyond the ability to deliver such a frame, and the vulnerability is not present in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

AWS

AWS SDK for Go v2

unaffected

Version	Status	Constraints
`0`	affected	< 2026-03-23

No data.

Vendor Product Versions

Aws

Aws Sdk For Go V2

Version	Status	Scheme	Platform
`[0,2026-03-23)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade AWS SDK for Go v2 to release‑2026‑03‑23 or later.
Apply the same patch to any forked or derivative SDK code supervision or health checks to automatically restart services that crash from SDK panics, minimizing downtime until a formal update is applied.
Lock the dependency to the patched SDK version in your Go module file (go.mod) and enforce it in CI/CD to prevent accidental use of vulnerable releases.

Generated by OpenCVE AI on September 21, 2026 at 04:19 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.305% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://aws.amazon.com/security/security-bulletins/2026-110-aws/
https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23
https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2
https://nvd.nist.gov/vuln/detail/CVE-2026-89090
https://www.cve.org/CVERecord?id=CVE-2026-89090

History

Sep 15, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89090 https://www.cve.org/CVERecord?id=CVE-2026-89090
Metrics	threat_severity `None`	threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range. To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.
Title		Denial of service in the event stream header decoder in AWS SDK for Go v2
First Time appeared		Aws Aws aws Sdk For Go V2
Weaknesses		CWE-248
CPEs		cpe:2.3:a:aws:aws_sdk_for_go_v2::::::::
Vendors & Products		Aws Aws aws Sdk For Go V2
References		https://aws.amazon.com/security/security-bulletins/2026-110-aws/ https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23 https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`