CVE-2026-89090

CVE-2026-89090 is an unrecovered panic (CWE-248, uncaught exception) in the event stream header decoder of Amazon AWS SDK for Go v2. An unauthenticated remote actor can trigger it by sending a crafted event stream response frame containing a header value type outside the valid range, which causes the consuming application process to terminate rather than return a handled error. The attacker gains only availability impact — a crash or repeated crashes of the application — with no confidentiality or integrity impact, consistent with the CVSS 4.0 vector's high availability score and high attack complexity. Any application or service built with AWS SDK for Go v2 prior to release-2026-03-23 that processes event stream encoded responses is affected, as are forks or derivative copies of the affected code. There is currently no known exploitation, no public proof-of-concept, and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Upgrade AWS SDK for Go v2 to release-2026-03-23 or later, and patch any forked or derivative copies of the event stream decoder code, since the advisory requires both. Inventory which of your Go applications consume event stream encoded responses from AWS services and whether those responses can be influenced by untrusted actors. As an interim mitigation, consider whether crash/restart handling (e.g., supervisor or orchestrator restarts) covers the affected processes, but do not treat this as a substitute for upgrading.