What is CVE-2026-89090?

CVE-2026-89090 is a medium-severity vulnerability in AWS Sdk For Go V2, classified under CWE-248. CVSS score: 5.9/10. Published 2026-09-11.

How severe is CVE-2026-89090?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in AWS Sdk For Go V2

CVE-2026-89090

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range. To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Aws Sdk For Go V2

Weakness classification (CWE)

CWE-248

References

ff89ba41-3aa1-4d27-914a-91399e9639e5 (third-party-advisory)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (patch)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory)

Frequently asked questions

What is CVE-2026-89090?: CVE-2026-89090 is a medium-severity vulnerability in AWS Sdk For Go V2, classified under CWE-248. CVSS score: 5.9/10. Published 2026-09-11.
How severe is CVE-2026-89090?: Medium severity. CVSS v3 base score is 5.9 out of 10.