CVE-2026-89090
Awaiting Analysis Awaiting Analysis - Queue

Panic in AWS SDK for Go v2 Event Stream Decoder

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: AMZN

Description
An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range. To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89090
EUVD
EUVD-2026-76157

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
amazon aws_sdk_for_go to 2026-03-23 (inc)
amazon aws_sdk_for_go_v2 to 2026-03-23 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Denial of Service (DoS) vulnerability in the AWS SDK for Go v2. It occurs due to an unrecovered panic in the event stream header decoder. An unauthenticated remote attacker can send a crafted event stream response frame with a header value type outside the valid range, causing the consuming application process to terminate.

Detection Guidance

Detecting this vulnerability requires checking the version of the AWS SDK for Go v2 in use. Commands like 'go list -m github.com/aws/aws-sdk-go-v2' or inspecting go.mod files can identify if an outdated version is present. Network detection may involve monitoring for malformed EventStream responses or process terminations in applications using the SDK.

Impact Analysis

This vulnerability allows an attacker to disrupt your application by sending malformed data. If your application uses the AWS SDK for Go v2 before version 2026-03-23, it could crash, leading to service unavailability or downtime. The impact is limited to applications using vulnerable SDK versions.

Mitigation Strategies

Immediately upgrade the AWS SDK for Go v2 to release-2026-03-23 or later. Review and update any forked or derivative code to include the patch. Ensure all dependent services and applications are restarted to apply the fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89090. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart