Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
**CVSSv3.1 Rating**: [Medium] **CVSSv3.1 Score**: [5.9] **CVSSv3.1 Vector String**: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H] ## Summary and Impact An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23). An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate. Impacted versions: < [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23) ## Patches This issue has been addressed in versions [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23) and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. ## Workarounds Not Applicable ## References If you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [[email protected]](mailto:[email protected]). Please do not create a public GitHub issue.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (Go) | before 1.7.8 | 1.7.8 | Patch available | GHSA-xmrv-pmrh-hhx2 |
| — | github.com/aws/aws-sdk-go-v2/service/bedrockagentcore (Go) | before 1.15.2 | 1.15.2 | Patch available | GHSA-xmrv-pmrh-hhx2 |
| — | github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime (Go) | before 1.51.8 | 1.51.8 | Patch available | GHSA-xmrv-pmrh-hhx2 |
| — | github.com/aws/aws-sdk-go-v2/service/bedrockruntime (Go) | before 1.50.4 | 1.50.4 | Patch available | GHSA-xmrv-pmrh-hhx2 |
| — | github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs (Go) | before 1.65.0 | 1.65.0 | Patch available | GHSA-xmrv-pmrh-hhx2 |
| — | github.com/aws/aws-sdk-go-v2/service/iotsitewise (Go) | before 1.52.19 | 1.52.19 | Patch available | GHSA-xmrv-pmrh-hhx2 |
| — | github.com/aws/aws-sdk-go-v2/service/kinesis (Go) | before 1.43.5 | 1.43.5 | Patch available | GHSA-xmrv-pmrh-hhx2 |
| — | github.com/aws/aws-sdk-go-v2/service/lambda (Go) | before 1.88.5 | 1.88.5 | Patch available | GHSA-xmrv-pmrh-hhx2 |
| — | github.com/aws/aws-sdk-go-v2/service/lexruntimev2 (Go) | before 1.35.15 | 1.35.15 | Patch available | GHSA-xmrv-pmrh-hhx2 |
| — | github.com/aws/aws-sdk-go-v2/service/s3 (Go) | before 1.97.3 | 1.97.3 | Patch available | GHSA-xmrv-pmrh-hhx2 |
| — | github.com/aws/aws-sdk-go-v2/service/sagemakerruntime (Go) | before 1.39.6 | 1.39.6 | Patch available | GHSA-xmrv-pmrh-hhx2 |
| — | github.com/aws/aws-sdk-go-v2/service/transcribestreaming (Go) | before 1.34.5 | 1.34.5 | Patch available | GHSA-xmrv-pmrh-hhx2 |
- github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (Go) Vendor— Affected before 1.7.8 Fixed in 1.7.8 Patch available GHSA-xmrv-pmrh-hhx2
- github.com/aws/aws-sdk-go-v2/service/bedrockagentcore (Go) Vendor— Affected before 1.15.2 Fixed in 1.15.2 Patch available GHSA-xmrv-pmrh-hhx2
- github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime (Go) Vendor— Affected before 1.51.8 Fixed in 1.51.8 Patch available GHSA-xmrv-pmrh-hhx2
- github.com/aws/aws-sdk-go-v2/service/bedrockruntime (Go) Vendor— Affected before 1.50.4 Fixed in 1.50.4 Patch available GHSA-xmrv-pmrh-hhx2
- github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs (Go) Vendor— Affected before 1.65.0 Fixed in 1.65.0 Patch available GHSA-xmrv-pmrh-hhx2
- github.com/aws/aws-sdk-go-v2/service/iotsitewise (Go) Vendor— Affected before 1.52.19 Fixed in 1.52.19 Patch available GHSA-xmrv-pmrh-hhx2
- github.com/aws/aws-sdk-go-v2/service/kinesis (Go) Vendor— Affected before 1.43.5 Fixed in 1.43.5 Patch available GHSA-xmrv-pmrh-hhx2
- github.com/aws/aws-sdk-go-v2/service/lambda (Go) Vendor— Affected before 1.88.5 Fixed in 1.88.5 Patch available GHSA-xmrv-pmrh-hhx2
- github.com/aws/aws-sdk-go-v2/service/lexruntimev2 (Go) Vendor— Affected before 1.35.15 Fixed in 1.35.15 Patch available GHSA-xmrv-pmrh-hhx2
- github.com/aws/aws-sdk-go-v2/service/s3 (Go) Vendor— Affected before 1.97.3 Fixed in 1.97.3 Patch available GHSA-xmrv-pmrh-hhx2
- github.com/aws/aws-sdk-go-v2/service/sagemakerruntime (Go) Vendor— Affected before 1.39.6 Fixed in 1.39.6 Patch available GHSA-xmrv-pmrh-hhx2
- github.com/aws/aws-sdk-go-v2/service/transcribestreaming (Go) Vendor— Affected before 1.34.5 Fixed in 1.34.5 Patch available GHSA-xmrv-pmrh-hhx2
Remediation
- Fix · GHSA-xmrv-pmrh-hhx2 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (Go) Fixed in 1.7.8 Advisory →
- Fix · GHSA-xmrv-pmrh-hhx2 github.com/aws/aws-sdk-go-v2/service/bedrockagentcore (Go) Fixed in 1.15.2 Advisory →
- Fix · GHSA-xmrv-pmrh-hhx2 github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime (Go) Fixed in 1.51.8 Advisory →
- Fix · GHSA-xmrv-pmrh-hhx2 github.com/aws/aws-sdk-go-v2/service/bedrockruntime (Go) Fixed in 1.50.4 Advisory →
- Fix · GHSA-xmrv-pmrh-hhx2 github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs (Go) Fixed in 1.65.0 Advisory →
- Fix · GHSA-xmrv-pmrh-hhx2 github.com/aws/aws-sdk-go-v2/service/iotsitewise (Go) Fixed in 1.52.19 Advisory →
- Fix · GHSA-xmrv-pmrh-hhx2 github.com/aws/aws-sdk-go-v2/service/kinesis (Go) Fixed in 1.43.5 Advisory →
- Fix · GHSA-xmrv-pmrh-hhx2 github.com/aws/aws-sdk-go-v2/service/lambda (Go) Fixed in 1.88.5 Advisory →
- Fix · GHSA-xmrv-pmrh-hhx2 github.com/aws/aws-sdk-go-v2/service/lexruntimev2 (Go) Fixed in 1.35.15 Advisory →
- Fix · GHSA-xmrv-pmrh-hhx2 github.com/aws/aws-sdk-go-v2/service/s3 (Go) Fixed in 1.97.3 Advisory →
- Fix · GHSA-xmrv-pmrh-hhx2 github.com/aws/aws-sdk-go-v2/service/sagemakerruntime (Go) Fixed in 1.39.6 Advisory →
- Fix · GHSA-xmrv-pmrh-hhx2 github.com/aws/aws-sdk-go-v2/service/transcribestreaming (Go) Fixed in 1.34.5 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-xmrv-pmrh-hhx2
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences