Denial of service in the event stream header decoder in AWS SDK for Go v2

Summary

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range. To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.

Timeline

1. Sep 11, 2026, 5:03 PM UTCCVE published
2. Sep 11, 2026, 7:19 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Sep 24, 2026, 7:29 PM UTCRecord last updated

Affected versions

• AWS AWS SDK for Go v2

  fixed in 2026-03-23

• github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamGo

  fixed in 1.7.8

• github.com/aws/aws-sdk-go-v2/service/bedrockagentcoreGo

  fixed in 1.15.2

• github.com/aws/aws-sdk-go-v2/service/bedrockagentruntimeGo

  fixed in 1.51.8

• github.com/aws/aws-sdk-go-v2/service/bedrockruntimeGo

  fixed in 1.50.4

• github.com/aws/aws-sdk-go-v2/service/cloudwatchlogsGo

  fixed in 1.65.0

• github.com/aws/aws-sdk-go-v2/service/iotsitewiseGo

  fixed in 1.52.19

• github.com/aws/aws-sdk-go-v2/service/kinesisGo

  fixed in 1.43.5

• github.com/aws/aws-sdk-go-v2/service/lambdaGo

  fixed in 1.88.5

• github.com/aws/aws-sdk-go-v2/service/lexruntimev2Go

  fixed in 1.35.15

• github.com/aws/aws-sdk-go-v2/service/s3Go

  fixed in 1.97.3

• github.com/aws/aws-sdk-go-v2/service/sagemakerruntimeGo

  fixed in 1.39.6

• github.com/aws/aws-sdk-go-v2/service/transcribestreamingGo

  fixed in 1.34.5

References 3