CVE-2026-89090: Denial of service in the event stream header decoder in AWS SDK for Go v2
An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.
To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon AWS SDK for Go v2to a version that resolves this vulnerability.Fixed in release-2026-03-23
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service condition?
Applications that consume event streams using affected versions of AWS SDK for Go v2 are exposed if they can receive a crafted event stream response frame. The issue can terminate the consuming application process.
Does an attacker need credentials or user interaction to trigger the issue?
No credentials or user interaction are required according to the supplied vector. Exploitation requires a crafted event stream response frame with a header value type outside the valid range, and the attack complexity is rated high.
What is the recommended remediation?
Upgrade AWS SDK for Go v2 to release-2026-03-23 or later. Any forked or derivative code should also be patched.