VDB
CVE-2026-89090
CVE-2026-89090
PUBLISHED
CVSS 5.9 MEDIUM
Reported by AMZN · Published September 11, 2026
An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range. To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.
Risk Scores
CVSS 3.1
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| AWS | AWS SDK for Go v2 | 0 |
| aws | aws_sdk_for_go_v2 | 0 |
| AWS | AWS SDK for Go v2 | 0 |
| AWS | AWS SDK for Go v2 |
Timeline
- Sep 11, 2026 CVE Published
- Sep 11, 2026 CVE Updated
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score