CVE-2026-89090: AWS SDK for Go v2 DOS Vulnerability

CVE-2026-89090 Overview

CVE-2026-89090 is an unrecovered panic vulnerability in the event stream header decoder of the Amazon AWS SDK for Go v2. An unauthenticated remote actor can send a crafted event stream response frame containing a header value type outside the valid range. The malformed frame triggers an unrecovered panic in the consuming application, terminating the process. The issue affects all releases prior to release-2026-03-23 and is classified under CWE-248: Uncaught Exception. AWS published the fix on March 23, 2026, and issued AWS Security Bulletin 2026-110 alongside GitHub Security Advisory GHSA-xmrv-pmrh-hhx2.

Critical Impact
A single crafted event stream frame from a network-reachable endpoint can terminate any Go application consuming AWS services that use event streaming, producing a denial-of-service condition without authentication.

Affected Products

Amazon AWS SDK for Go v2 (aws-sdk-go-v2) releases prior to release-2026-03-23
Any Go application consuming AWS services that use event stream protocols (for example, Amazon S3 SelectObjectContent, Kinesis SubscribeToShard, Transcribe Streaming, Lex, Bedrock streaming responses)
Forked or derivative code that reuses the vulnerable event stream header decoder

Discovery Timeline

2026-03-23 - AWS releases release-2026-03-23 containing the fix
2026-09-11 - CVE-2026-89090 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89090

Vulnerability Analysis

The AWS SDK for Go v2 uses the application/vnd.amazon.eventstream binary framing protocol to consume streaming responses from services such as S3 Select, Kinesis, Transcribe, and Bedrock. Each frame contains a set of headers, and each header value is tagged with a type byte identifying the encoding (boolean, byte, string, timestamp, UUID, and so on). The event stream header decoder reads this type byte and dispatches to a type-specific parser.

When the decoder receives a header value type byte outside the defined enumerated range, it does not return a structured decoding error. Instead, execution reaches a code path that panics without a surrounding recover(). Because event stream responses are typically consumed on background goroutines spawned by the SDK, the unhandled panic unwinds the goroutine stack and terminates the entire process. The remediation is available in GitHub release release-2026-03-23.

Root Cause

The root cause is an uncaught exception [CWE-248] in the header-type dispatch logic. The decoder trusts the type byte value read from the network frame and lacks a validated fallback for unknown or reserved type identifiers. Combined with the absence of a defer recover() at the goroutine boundary that runs the stream reader, any panic propagates to the runtime and calls os.Exit behavior via unrecovered panic handling.

Attack Vector

Exploitation requires the target application to consume an event stream response controlled by the attacker. Practical attack scenarios include a compromised or malicious AWS endpoint, an attacker-in-the-middle position when TLS validation is misconfigured, or a proxy or SDK-compatible service that returns crafted event stream frames. The attacker sends a frame whose header prelude declares a header value type byte outside the valid enumerated range. Upon decoding, the SDK panics and the host process exits, producing denial of service against any long-running consumer such as a data pipeline, ingestion worker, or API service.

No authentication or user interaction is required at the network layer. The attack complexity is elevated because the attacker must reach the SDK consumer with attacker-controlled event stream bytes, which is why the CVSS availability impact is High while confidentiality and integrity impacts are None.

Detection Methods for CVE-2026-89090

Indicators of Compromise

Unexpected process termination in Go services with stack traces referencing github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream decoder functions
Runtime log entries containing panic: messages immediately following event stream response processing for S3 Select, Kinesis, Transcribe, Bedrock, or Lex streaming APIs
Repeated crash-restart loops in containers or systemd-managed workers that consume AWS streaming services

Detection Strategies

Inventory Go binaries and container images that import github.com/aws/aws-sdk-go-v2 at versions predating release-2026-03-23 using go version -m or SBOM tooling
Correlate application crash telemetry with outbound connections to AWS event stream endpoints to identify triggered conditions
Monitor for anomalous DNS resolution or TLS SNI values pointing AWS SDK clients to non-AWS hosts, which may indicate redirection to a malicious event stream source

Monitoring Recommendations

Enable structured panic logging and export crash counts as a metric to alert on sudden increases in unrecovered panics
Track SDK version distribution across the fleet in a central inventory to surface hosts still running vulnerable builds
Ingest process exit codes and container restart events into the SIEM to detect denial-of-service patterns targeting streaming consumers

How to Mitigate CVE-2026-89090

Immediate Actions Required

Upgrade github.com/aws/aws-sdk-go-v2 and all sub-modules that carry the eventstream package to release-2026-03-23 or later, then rebuild and redeploy affected binaries
Audit any forked or vendored copies of the AWS SDK for Go v2 and apply the equivalent patch from the upstream commit
Restrict AWS SDK egress to validated AWS service endpoints and enforce strict TLS certificate validation to prevent redirection to attacker-controlled event stream sources

Patch Information

The fix is included in the aws-sdk-go-v2 release-2026-03-23 release. Consumers should update their go.mod to reference module versions dated on or after this release and run go mod tidy followed by a full rebuild. Refer to GHSA-xmrv-pmrh-hhx2 and AWS Security Bulletin 2026-110 for the full list of affected modules and their patched versions.

Workarounds

Wrap goroutines that invoke event stream APIs with defer recover() blocks to convert panics into logged errors and prevent process termination until the patch is deployed
Disable or avoid using event streaming APIs such as S3 SelectObjectContent, Kinesis SubscribeToShard, and Bedrock streaming invocations where feasible
Deploy the service behind a supervisor that rate-limits restarts to reduce impact from crash-loop denial of service

bash

# Configuration example
# Update the AWS SDK for Go v2 to the patched release
go get github.com/aws/aws-sdk-go-v2@release-2026-03-23
go get github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@release-2026-03-23
go mod tidy
go build ./...

# Verify the resolved version no longer matches vulnerable builds
go list -m github.com/aws/aws-sdk-go-v2