CVE-2026-89090: Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

CVE-2026-89090 · Severity: high · CVSS 3.1 · Published 2026-07-07

A vulnerability in the AWS SDK for Go v2 allows an attacker to remotely terminate applications that use this SDK by sending a malformed EventStream response with a crafted invalid header type byte. This affects any Go application that processes AWS service responses, potentially causing service unavailability and operational disruption for dependent systems.

Technologies: Amazon AWS. Vendors: Amazon, Amazon Web Services, Go.

Quick answers

Is CVE-2026-89090 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-89090 being exploited in the wild.
How severe is CVE-2026-89090?
High severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?
Amazon Web Services AWS SDK for Go < 2026-03-23; github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (Go) SEMVER:introduced=0,fixed=1.7.8; github.com/aws/aws-sdk-go-v2/service/bedrockagentcore (Go) SEMVER:introduced=0,fixed=1.15.2; github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime (Go) SEMVER:introduced=0,fixed=1.51.8; and 9 more.
Is there a fix for CVE-2026-89090?
Yes. github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (Go): upgrade to 1.7.8 or later; github.com/aws/aws-sdk-go-v2/service/bedrockagentcore (Go): upgrade to 1.15.2 or later; github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime (Go): upgrade to 1.51.8 or later; github.com/aws/aws-sdk-go-v2/service/bedrockruntime (Go): upgrade to 1.50.4 or later; github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs (Go): upgrade to 1.65.0 or later; github.com/aws/aws-sdk-go-v2/service/iotsitewise (Go): upgrade to 1.52.19 or later; github.com/aws/aws-sdk-go-v2/service/kinesis (Go): upgrade to 1.43.5 or later; github.com/aws/aws-sdk-go-v2/service/lambda (Go): upgrade to 1.88.5 or later; github.com/aws/aws-sdk-go-v2/service/lexruntimev2 (Go): upgrade to 1.35.15 or later; github.com/aws/aws-sdk-go-v2/service/s3 (Go): upgrade to 1.97.3 or later; github.com/aws/aws-sdk-go-v2/service/sagemakerruntime (Go): upgrade to 1.39.6 or later; github.com/aws/aws-sdk-go-v2/service/transcribestreaming (Go): upgrade to 1.34.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89090 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-89090?
Check whether you run Amazon AWS, Amazon Web Services AWS SDK for Go, github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (Go): upgrade to 1.7.8 or later
    go get github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.8
  • github.com/aws/aws-sdk-go-v2/service/bedrockagentcore (Go): upgrade to 1.15.2 or later
    go get github.com/aws/aws-sdk-go-v2/service/bedrockagentcore@v1.15.2
  • github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime (Go): upgrade to 1.51.8 or later
    go get github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime@v1.51.8
  • github.com/aws/aws-sdk-go-v2/service/bedrockruntime (Go): upgrade to 1.50.4 or later
    go get github.com/aws/aws-sdk-go-v2/service/bedrockruntime@v1.50.4
  • github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs (Go): upgrade to 1.65.0 or later
    go get github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.65.0
  • github.com/aws/aws-sdk-go-v2/service/iotsitewise (Go): upgrade to 1.52.19 or later
    go get github.com/aws/aws-sdk-go-v2/service/iotsitewise@v1.52.19
  • github.com/aws/aws-sdk-go-v2/service/kinesis (Go): upgrade to 1.43.5 or later
    go get github.com/aws/aws-sdk-go-v2/service/kinesis@v1.43.5
  • github.com/aws/aws-sdk-go-v2/service/lambda (Go): upgrade to 1.88.5 or later
    go get github.com/aws/aws-sdk-go-v2/service/lambda@v1.88.5
  • github.com/aws/aws-sdk-go-v2/service/lexruntimev2 (Go): upgrade to 1.35.15 or later
    go get github.com/aws/aws-sdk-go-v2/service/lexruntimev2@v1.35.15
  • github.com/aws/aws-sdk-go-v2/service/s3 (Go): upgrade to 1.97.3 or later
    go get github.com/aws/aws-sdk-go-v2/service/s3@v1.97.3
  • github.com/aws/aws-sdk-go-v2/service/sagemakerruntime (Go): upgrade to 1.39.6 or later
    go get github.com/aws/aws-sdk-go-v2/service/sagemakerruntime@v1.39.6
  • github.com/aws/aws-sdk-go-v2/service/transcribestreaming (Go): upgrade to 1.34.5 or later
    go get github.com/aws/aws-sdk-go-v2/service/transcribestreaming@v1.34.5

Technical details

The vulnerability exists in the EventStream header decoder component of AWS SDK for Go v2, which fails to properly validate header value type bytes in incoming EventStream frames. An attacker who controls or can intercept traffic to an AWS service can craft a malformed response containing an out-of-range header type byte, triggering an unhandled error or panic condition that terminates the host process. The attack requires network access to the AWS service endpoint but no authentication or user interaction. Applications using AWS SDK for Go v2 versions before 2026-03-23 are vulnerable. Patches are available in versions released on or after 2026-03-23.

Affected products

  • AWS AWS SDK for Go v2 < 2026-03-23

Identifiers

  • CVE-2026-89090
  • GHSA-xmrv-pmrh-hhx2
  • GO-2026-5764

Timeline

  • 2026-09-11: disclosed
  • 2026-03-23: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.