Executive brief
A vulnerability in the AWS SDK for Go v2 allows an attacker to remotely terminate applications that use this SDK by sending a malformed EventStream response with a crafted invalid header type byte. This affects any Go application that processes AWS service responses, potentially causing service unavailability and operational disruption for dependent systems.
Technical details
The vulnerability exists in the EventStream header decoder component of AWS SDK for Go v2, which fails to properly validate header value type bytes in incoming EventStream frames. An attacker who controls or can intercept traffic to an AWS service can craft a malformed response containing an out-of-range header type byte, triggering an unhandled error or panic condition that terminates the host process. The attack requires network access to the AWS service endpoint but no authentication or user interaction. Applications using AWS SDK for Go v2 versions before 2026-03-23 are vulnerable. Patches are available in versions released on or after 2026-03-23.
Affected products
- AWS AWS SDK for Go v2 < 2026-03-23
Timeline
- 2026-09-11: disclosed
- 2026-03-23: patched