AWSAWS-2026-110
Denial of service in the event stream header decoder in AWS SDK for Go v2
UnratedCVE-2026-89090 · Published Sep 11, 2026
Bulletin ID: 2026-110-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/11/2026 10:00 AM PDT Description: An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating 2026-03-23. An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate. Impacted versions: < 2026-03-23 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
- Severity from
- no source yet
More AWS advisories
All AWS| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 11 | Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration UnratedSep 11 | Unrated | No fix yet |
| Sep 11 | XML External Entity (XXE) in AWS Advanced JDBC Wrapper RemoteQueryCachePluginUnratedSep 11 | Unrated | No fix yet |
| Sep 11 | Issue with projen - Path traversal and OS command injectionUnratedSep 11 | Unrated | No fix yet |
| Sep 10 | Server-side request forgery in the Session Manager port forwarding functionality in AWS...UnratedSep 10 | Unrated | No fix yet |
| Sep 10 | Integer overflow in tensor buffer validation in Deep Java LibraryUnratedSep 10 | Unrated | No fix yet |
| Sep 10 | Missing S3 bucket ownership verification in the AWS Security Agent plugin for...UnratedSep 10 | Unrated | No fix yet |