CVE-2026-89090Disclosure

LOWCVSS 8.2 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range. To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-248

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Rıdvan Yağlı@ridvanyagli46d
Patch
🔴 AWS SDK for Go v2'de yüksek seviyeli DoS açığı: CVE-2026-89090 AWS SDK for Go v2'nin EventStream Header Decoder bileşeninde CVSS 4.0: 8.2 (HIGH) seviyesinde güvenlik açığı tespit edildi. Kimlik doğrulaması gerektirmeyen uzaktaki bir saldırgan, özel hazırlanmış bir EventStream response frame göndererek geçersiz header value type oluşturabiliyor. Bu durum, SDK'da kontrolsüz panic meydana getirerek consuming Go uygulamasının sonlandırılmasına ve DoS oluşmasına neden oluyor. Etkilenen: AWS SDK for Go v2 < release-2026-03-23 Çözüm: release-2026-03-23 veya sonrası sürümler ⚠️ Açık RCE değil; temel etkisi uygulamanın kullanılabilirliğinin kaybedilmesi. https://aws.amazon.com/es/security/security-bulletins/2026-110-aws/
Post summary
The text discloses a high-severity unauthenticated remote DoS vulnerability in AWS SDK for Go v2's EventStream Header Decoder, with technical impact details and a fixed version. It does not report PoC, exploit tooling, or active exploitation.
00000199
2.3K followersView on X
CERT-PY@CERTpy46d
Disclosure
⚠️ Vulnerabilidad en Componentes de AWS ❗ CVE-2026-89090 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-componentes-de-aws-2/ https://t.co/Ix25Xu8lCd
Post summary
The tweet announces the discovery of CVE‑2026‑89090 affecting AWS components and points to a CERT Paraguay advisory for further details, without providing PoC, exploit, patch, or active exploitation information.
00000257
6.7K followersView on X

Explore more

Back to dashboard