Medium severity5.9NVD Advisory· Published Sep 11, 2026· Updated Sep 11, 2026
CVE-2026-89090
CVE-2026-89090
Description
An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.
To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.
Affected products
7- Range: <release-2026-03-23
- osv-coords5 versionspkg:rpm/opensuse/alloy&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/alloy&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/amazon-ecs-init&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/keybase-client&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/keybase-client&distro=openSUSE%20Tumbleweed
< 1.19.2-160000.1.1+ 4 more
- (no CPE)range: < 1.19.2-160000.1.1
- (no CPE)range: < 1.19.2-1.1
- (no CPE)range: < 1.108.0-1.1
- (no CPE)range: < 6.6.3-bp160.4.1
- (no CPE)range: < 6.6.3-5.1
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.