CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2
Sdk For ยท 2026-10-25
Actions
Technical Details
| Affected Versions | < 2026-03-23 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-89090 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update the AWS SDK for Go v2 to version 2026-03-23 or above to resolve the CVE-2026-89090 vulnerability, which can cause the host process to terminate if exploited.
For Platform Teams
Deploy the patched version of the AWS SDK for Go v2 to ensure the EventStream header decoder is secure against malformed response frames, maintaining system integrity and performance.
For Executives
Implement the latest AWS SDK for Go v2 to mitigate the risk of denial of service attacks due to a vulnerability in the EventStream header decoder, ensuring system stability and security.
Source
Related Sdk For Updates
- CVE-2026-19642 & CVE-2026-19643 - Memory-safety issues in the Base64 decoder in the AWS SDK for C++ (2026-10-21)
- CVE-2026-6550 - Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python (2026-10-14)
- CVE-2026-6550 - Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python (2026-09-29)
- Introducing SDK Client Warm-Up feature in the AWS SDK for Java 2.x (2026-09-25)
- CVE-2026-6550 - Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python (2026-09-25)