{"id":"GO-2026-5764","summary":"DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","details":"DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","aliases":["CVE-2026-89090","GHSA-xmrv-pmrh-hhx2"],"modified":"2026-09-12T04:10:37.759930105Z","published":"2026-07-07T16:52:19Z","related":["CGA-p88r-6hfx-gqr6"],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-5764","review_status":"REVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2"},{"type":"WEB","url":"https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23"}],"affected":[{"package":{"name":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.8"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5764.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/bedrockagentcore","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/bedrockagentcore"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.2"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5764.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.51.8"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5764.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/bedrockruntime","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/bedrockruntime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.50.4"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5764.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.65.0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5764.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/iotsitewise","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/iotsitewise"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.52.19"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5764.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/kinesis","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/kinesis"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.43.5"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5764.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/lambda","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/lambda"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.88.5"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5764.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/lexruntimev2","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/lexruntimev2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.35.15"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5764.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/s3","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/s3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.97.3"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5764.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/sagemakerruntime","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/sagemakerruntime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.39.6"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5764.json"}},{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/transcribestreaming","ecosystem":"Go","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/transcribestreaming"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.34.5"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5764.json"}}],"schema_version":"1.7.5"}