CVE-2026-89090

A flaw was found in the event stream header decoder of the Amazon AWS SDK for Go v2. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted event stream response frame. This frame, containing a header value type outside the valid range, would cause an unrecovered panic, leading to the termination of the consuming application process and resulting in a Denial of Service (DoS).

A flaw in AWS SDK for Go v2 can cause an application to terminate when it processes an attacker-controlled EventStream response with a crafted header.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade affected AWS SDK for Go v2 modules to the fixed releases published after 2026-03-23. There is no documented workaround.