Bug 2531982 (CVE-2026-89090)
| Summary: | CVE-2026-89090 github.com/aws/aws-sdk-go-v2: Amazon AWS SDK for Go v2: Denial of Service via crafted event stream header | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aazores, abarbaro, agarcial, akhatavk, akoudelk, alebedev, alinfoot, alizardo, amctagga, anjoseph, anpicker, anthomas, aoconnor, aos-team-art-private, aruklets, asdas, asegurap, asyoung, bniver, bparees, cahl, chfoley, ckandaga, cmah, crizzo, dfreiber, dhanak, dkeler, doconnor, dpaolell, drosa, drow, dsimansk, dtrifiro, dymurray, eaguilar, ebaron, eborisov, eglynn, ehelms, flucifre, gbenhaim, ggainey, gmeno, gparvin, groman, gtanzill, hasun, jbalunas, jburrell, jbuscemi, jcantril, jchui, jdelft, jdobes, jeder, jfula, jhe, jhollowa, jjoyce, jmatsuok, jmatthew, jowilson, jpasqual, jprabhak, jpretori, jsamir, jschluet, jsherril, jtolenti, jturenov, jupierce, juwatts, kaycoth, kbempah, kingland, kshier, ktsao, lball, lbragsta, lchilton, lgarciaa, lhh, ljawale, mbenjamin, mbiarnes, mburns, mdellweg, mgarciac, mhackett, mhulan, mnovotny, msilmser, mwringe, nboldt, ngough, niyer, nmoumoul, nyancey, oaljalju, ometelka, orabin, osousa, pakotvan, pcreech, pjindal, ppalepu, ppostler, prdhamdh, prichard, psrna, ptisnovs, pvasanth, rchan, rekumar, rhaigner, rhel-process-autobot, rjohnson, rojacob, sausingh, sdawley, sfeifer, sghai, sidsharm, smallamp, solenoci, sostapov, stcannon, sthirugn, suppawar, swoodman, syedriko, teagle, thason, tmalecek, tsze, twaugh, vereddy, veshanka, vkarehfa, vkumar, vlaad, vvoronko, watson-tool-maintainers, weaton, wenshen, whayutin, wtam, xdharmai, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the event stream header decoder of the Amazon AWS SDK for Go v2. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted event stream response frame. This frame, containing a header value type outside the valid range, would cause an unrecovered panic, leading to the termination of the consuming application process and resulting in a Denial of Service (DoS).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2533065, 2533074, 2533075, 2533076, 2533078, 2533080, 2533082, 2533083, 2533087, 2533090, 2533091, 2533092, 2533093, 2533096, 2533098, 2533064, 2533068, 2533070, 2533071, 2533073, 2533077, 2533079, 2533084, 2533085, 2533086, 2533088, 2533089, 2533094, 2533095, 2533097 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-09-11 17:34:48 UTC
|