CVE-2026-89090 Denial of service in the event stream header decoder in AWS SDK for Go v2
An unauthenticated remote attacker can crash the application by sending a crafted event stream response frame with an invalid header value type.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89090?
CVE-2026-89090 is a high-severity denial of service vulnerability in AWS SDK for Go v2, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.
To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.
Weakness: CWE-248
Which versions are affected by CVE-2026-89090?
36 open source packages ship an affected version, including github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream, github.com/aws/aws-sdk-go-v2/service/bedrockagentcore and github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime.
| Package | Affected | Fixed in |
|---|---|---|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream Go | All versions | 1.7.8 |
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream Go | All versions | 1.7.8 |
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream Go | All versions | 1.7.8 |
github.com/aws/aws-sdk-go-v2/service/bedrockagentcore Go | All versions | 1.15.2 |
github.com/aws/aws-sdk-go-v2/service/bedrockagentcore Go | All versions | 1.15.2 |
github.com/aws/aws-sdk-go-v2/service/bedrockagentcore Go | All versions | 1.15.2 |
30 more packages
github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime Go | All versions | 1.51.8 |
github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime Go | All versions | 1.51.8 |
github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime Go | All versions | 1.51.8 |
github.com/aws/aws-sdk-go-v2/service/bedrockruntime Go | All versions | 1.50.4 |
github.com/aws/aws-sdk-go-v2/service/bedrockruntime Go | All versions | 1.50.4 |
github.com/aws/aws-sdk-go-v2/service/bedrockruntime Go | All versions | 1.50.4 |
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs Go | All versions | 1.65.0 |
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs Go | All versions | 1.65.0 |
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs Go | All versions | 1.65.0 |
github.com/aws/aws-sdk-go-v2/service/iotsitewise Go | All versions | 1.52.19 |
github.com/aws/aws-sdk-go-v2/service/iotsitewise Go | All versions | 1.52.19 |
github.com/aws/aws-sdk-go-v2/service/iotsitewise Go | All versions | 1.52.19 |
github.com/aws/aws-sdk-go-v2/service/kinesis Go | All versions | 1.43.5 |
github.com/aws/aws-sdk-go-v2/service/kinesis Go | All versions | 1.43.5 |
github.com/aws/aws-sdk-go-v2/service/kinesis Go | All versions | 1.43.5 |
github.com/aws/aws-sdk-go-v2/service/lambda Go | All versions | 1.88.5 |
github.com/aws/aws-sdk-go-v2/service/lambda Go | All versions | 1.88.5 |
github.com/aws/aws-sdk-go-v2/service/lambda Go | All versions | 1.88.5 |
github.com/aws/aws-sdk-go-v2/service/lexruntimev2 Go | All versions | 1.35.15 |
github.com/aws/aws-sdk-go-v2/service/lexruntimev2 Go | All versions | 1.35.15 |
github.com/aws/aws-sdk-go-v2/service/lexruntimev2 Go | All versions | 1.35.15 |
github.com/aws/aws-sdk-go-v2/service/s3 Go | All versions | 1.97.3 |
github.com/aws/aws-sdk-go-v2/service/s3 Go | All versions | 1.97.3 |
github.com/aws/aws-sdk-go-v2/service/s3 Go | All versions | 1.97.3 |
github.com/aws/aws-sdk-go-v2/service/sagemakerruntime Go | All versions | 1.39.6 |
github.com/aws/aws-sdk-go-v2/service/sagemakerruntime Go | All versions | 1.39.6 |
github.com/aws/aws-sdk-go-v2/service/sagemakerruntime Go | All versions | 1.39.6 |
github.com/aws/aws-sdk-go-v2/service/transcribestreaming Go | All versions | 1.34.5 |
github.com/aws/aws-sdk-go-v2/service/transcribestreaming Go | All versions | 1.34.5 |
github.com/aws/aws-sdk-go-v2/service/transcribestreaming Go | All versions | 1.34.5 |
Linux distribution packages (2)
keybase-client openSUSE:Leap 16.0 | All versions | 6.6.3-bp160.4.1 |
keybase-client openSUSE:Tumbleweed | All versions | 6.6.3-5.1 |
How do I fix CVE-2026-89090?
Upgrade github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream to 1.7.8 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-89090 being exploited?
There is no known exploitation of CVE-2026-89090 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-CP99296, CLEANSTART-2026-FR67517, CLEANSTART-2026-GX04519, CLEANSTART-2026-NA25366, CLEANSTART-2026-RT08772, CLEANSTART-2026-RZ12683 and 415 more.