CVE-2026-89090

MediumCVSS 5.9/10Last modified Sep 11, 2026

Description

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.

To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
AWS	AWS SDK for Go v2	< 2026-03-23

References

Timeline

Published: Sep 11, 2026
Last modified: Sep 11, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-890918.8A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates mem CVE-2026-890924.2The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a respo CVE-2026-890935.3The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by CVE-2026-890949.9Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/templat CVE-2026-890965.9A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notificati CVE-2026-890974.3The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i CVE-2026-890985.5A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program asserti CVE-2026-890997.5A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory wi CVE-2026-89106.1The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is CVE-2026-891006.1The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL Fragment CVE-2026-891016.5The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Di CVE-2026-891026.5In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can l